Skip to content
Critical PHP RCE Vulnerabilities Disclosed: CVE-2026-109618 and CVE-2026-109619

Critical PHP RCE Vulnerabilities Disclosed: CVE-2026-109618 and CVE-2026-109619

First seen 22 Oct 2026, 14:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 16:14 UTC
  • •CVE-2026-109618 and CVE-2026-109619 are critical RCE vulnerabilities in PHP.
  • •Affected PHP versions include 8.5.0–8.5.11, 8.4.0–8.4.26, 8.3.0–8.3.35, and 8.2.0–8.2.34.
  • •AWS services are not directly impacted, but customers must upgrade to patched PHP versions immediately.

Two critical remote code execution vulnerabilities in PHP web runtimes, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026. These vulnerabilities allow unauthenticated attackers to execute arbitrary code on affected systems, potentially leading to data exposure or denial of service. The affected PHP versions include 8.5.0–8.5.11, 8.4.0–8.4.26, 8.3.0–8.3.35, and 8.2.0–8.2.34. AWS services are not directly impacted, but customers using these PHP versions should upgrade to patched versions (8.5.12, 8.4.27, 8.3.36, or 8.2.35) immediately. AWS has provided configuration-level mitigations for some services, but upgrading is the only complete fix. The first public proof of concept for CVE-2026-109618 was released on October 22, 2026, raising concerns about potential exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
Two critical RCE vulnerabilities in PHP were disclosed, allowing unauthenticated code execution.
News.Ycombinator
2026-10-22
First public PoC for CVE-2026-109618
A proof of concept for CVE-2026-109618 was released, increasing the risk of exploitation.
Sploitus

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 2

Common questions

Which PHP versions are affected?
Affected versions include PHP 8.5.0–8.5.11, 8.4.0–8.4.26, 8.3.0–8.3.35, and 8.2.0–8.2.34.
What should I do if I'm using an affected version?
Upgrade to the patched versions: 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately.
Is there any immediate mitigation available?
AWS has provided configuration-level controls, but upgrading PHP is the only complete fix.