Sploitus Critical PHP Vulnerabilities Exploited Before Public Disclosure
Article Content
- •CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE with a CVSS score of 9.2.
- •Exploitation attempts were detected four days before the vulnerabilities were publicly disclosed.
- •Patches were released on October 21, 2026, but exploitation continued immediately after.
Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both vulnerabilities allow unauthenticated remote code execution (RCE) and have a CVSS score of 9.2. The attack vector involves the `session.upload_progress` feature in PHP, which can be manipulated to execute arbitrary code. Patches were released on October 21, 2026, but exploitation attempts continued shortly after the fixes were made public. The vulnerabilities affect multiple PHP versions, including those that are no longer supported. Organizations are urged to apply the patches immediately and review their systems for potential exposure.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (404)
Following this threat?
Track Lazarus, Mirai and Amazon in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which PHP versions are affected?
Is there confirmed exploitation in the wild?
What immediate actions should I take?
Continue Reading
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails… 
Record $6.3 Billion Hack of Binance Attributed to North Korean Hackers On October 29, 2026, Binance, the world's largest cryptocurrency exchange, suffered a massive cyberattack resulting in the theft of approximately $6.3 billion in digital assets. The breach was reportedly executed through a compromised laptop belonging to a DevOps engineer, allowing attackers to gain unauthorized…