Skip to content
Critical PHP Vulnerabilities Discovered Amid AI-Driven Threats

Critical PHP Vulnerabilities Discovered Amid AI-Driven Threats

First seen 6 Nov 2026, 19:45 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 19:45 UTC
  • •CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP with CVSS scores of 9.2.
  • •Over 22.6 million systems are potentially at risk due to these vulnerabilities.
  • •AI-assisted discovery of vulnerabilities is increasing the pressure on open-source maintainers.

Two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were published on October 21, 2026, and are actively exploited, affecting millions of systems worldwide. Discovered with AI assistance, these flaws pose a significant risk as PHP underpins nearly 70% of websites. The vulnerabilities allow for remote code execution, with over 22.6 million instances potentially exposed. The vulnerabilities were added to the CISA KEV list on October 26, 2026, indicating active exploitation. The rapid discovery of these vulnerabilities highlights the risks associated with open-source software, especially as dependency chains complicate security. Open-source maintainers are overwhelmed with vulnerability reports, raising concerns about burnout and the sustainability of these projects. Organizations using PHP are urged to reassess their supply chains and security practices in light of these developments.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2d ago How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
Two critical vulnerabilities in PHP were disclosed, allowing for remote code execution.
Hackernoon
2026-10-26
CVE-2026-109618 and CVE-2026-109619 added to CISA KEV
CISA listed the vulnerabilities as actively exploited, raising alarm for affected systems.
Spiceworks
2026-10-26
First public PoC for CVE-2026-109619
Proof-of-concept code was made publicly available, increasing the risk of exploitation.
Hackernoon

More articles in this cluster (3)

Following this threat?

Track React2Shell and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 3

Common questions

What systems are affected by these vulnerabilities?
The vulnerabilities affect PHP, which is used by nearly 70% of the world's websites, including major platforms like WordPress.
How urgent is it to address these vulnerabilities?
It is critical to address these vulnerabilities immediately, as they are actively exploited and pose a significant risk.
What steps should organizations take to mitigate risk?
Organizations should reassess their use of PHP, apply any available patches, and review their dependency management practices.