Linuxsecurity Critical PHP Vulnerabilities in SUSE and openSUSE Lead to Remote Code Execution Risks
Article Content
- •CVE-2026-109618 and CVE-2026-109619 allow RCE via memory corruption.
- •Patches for affected PHP versions are critical and should be applied immediately.
- •Public PoC for CVE-2026-109618 was released on October 23, 2026.
SUSE has released updates for PHP 7.4 and PHP 8 addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow remote code execution (RCE) without authentication. These vulnerabilities stem from memory corruption issues affecting various PHP versions. The flaws were disclosed on October 21, 2026, with a public proof-of-concept (PoC) for CVE-2026-109618 released on October 23, 2026. Systems running SUSE Linux Enterprise Server and openSUSE are particularly at risk. Administrators are urged to apply the patches immediately to mitigate potential exploitation. The vulnerabilities have been rated critical, with CVSS scores of 9.2. Affected systems include PHP 7.4 and PHP 8.0. The updates are available through SUSE's recommended installation methods.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which PHP versions are affected?
What is the severity of these vulnerabilities?
How can I apply the patches?
Continue Reading
PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like… 
Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both…