Critical PHP Vulnerabilities Exploited During Cybersecurity Black Week

pulse.infra-trust.org

Critical PHP Vulnerabilities Exploited During Cybersecurity Black Week

First seen 28 Oct 2026, 14:44 UTC • •72.9

Article Content

1 / 3

Browse articles

ThreatCluster •October 28, 2026 at 16:11 UTC

•PHP2Shell vulnerabilities allow unauthenticated remote code execution on PHP servers.
•CVE-2026-109618 and CVE-2026-109619 were added to the CISA KEV list for active exploitation.
•Government agencies urged immediate patching of affected PHP versions to mitigate risks.

During the week leading up to October 25, 2026, multiple critical vulnerabilities were disclosed, including PHP2Shell, which consists of two memory-safety flaws (CVE-2026-109618 and CVE-2026-109619) with a CVSS score of 9.2, allowing unauthenticated remote code execution on PHP servers. PHP powers approximately 69% of known websites, prompting urgent advisories from government agencies in the U.S. And Europe for immediate patching. The vulnerabilities were publicly disclosed on October 21, 2026, and were added to the CISA KEV list for on October 26, 2026. Other notable vulnerabilities included a maximum-severity flaw in GitLab and issues in the Linux kernel and Node.js. The rapid pace of disclosures and the need for swift remediation put immense pressure on security teams. Organizations were advised to isolate affected systems or take them offline if immediate patching was not possible.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-21

PHP vulnerabilities disclosed

CVE-2026-109618 and CVE-2026-109619 were published, allowing RCE on PHP servers.

2026-10-21

CVE-2026-109618 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-10-21

CVE-2026-109619 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-10-22

CISA KEV listing for PHP vulnerabilities

CVE-2026-109618 and CVE-2026-109619 were added to the CISA KEV list for active exploitation.

2026-10-22

CVE-2026-111497 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-10-22

CVE-2026-110264 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-10-26

Public PoC for PHP vulnerabilities

First public proof-of-concept for CVE-2026-109619 was released, increasing exploitation risk.

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which PHP versions are affected?

PHP versions 5.4 through 8.5.11 are affected by the vulnerabilities.

Is there a patch available?

Yes, the PHP project released fixes on October 21, 2026, for the affected versions.

What should organizations do immediately?

Organizations should patch affected systems immediately or isolate them if patching cannot be done promptly.

Continue Reading

China-linked Hackers Exploit PHP2Shell to Compromise 25 Firewalls A China-linked threat actor has exploited vulnerabilities in PHP2Shell (CVE-2026-109618, CVE-2026-109619) and the Fragnesia privilege escalation bug (CVE-2026-46300) to gain root access to 25 firewalls, including those in an U.S. The attackers identified vulnerable systems using the FOFA search engine and executed…

PHP2Shell Vulnerabilities Exploited by AI-Driven Attackers Threat actors have exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target a government entity in Europe, gaining access to sensitive data within two hours of the initial breach. The attackers utilized AI tools for reconnaissance and post-exploitation activities, including accessing…