Yorku.Ca Critical PHP Remote Code Execution Vulnerabilities Disclosed
Article Content
- •CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution.
- •Approximately 884,000 internet-facing hosts are at risk due to these vulnerabilities.
- •Security updates are available; immediate application is strongly recommended.
Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP versions 5.x to 8.4.26 have been disclosed. These vulnerabilities allow unauthenticated remote code execution, potentially compromising approximately 884,000 internet-facing hosts. CVE-2026-109618 is a pointer underflow vulnerability in PHP's CGI SAPI, while CVE-2026-109619 involves global state corruption after a fatal error. Security updates are available, and administrators are urged to apply them immediately. The vulnerabilities were first publicly disclosed on October 21, 2026, and were added to the CISA KEV list on October 26, 2026, indicating attempts. Early reports suggest attempts to exploit these vulnerabilities have already been observed. Organizations are advised to prioritize patching internet-facing PHP systems and to consider taking vulnerable systems offline if immediate updates cannot be applied.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which PHP versions are affected?
Is there confirmed exploitation in the wild?
What should I do to protect my systems?
Continue Reading
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25… 
PHP2Shell Vulnerabilities Exploited by AI-Driven Attackers Threat actors have exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target a government entity in Europe, gaining access to sensitive data within two hours of the initial breach. The attackers utilized AI tools for reconnaissance and post-exploitation activities, including accessing…