Skip to content
Critical RCE Vulnerabilities in PHP

Critical RCE Vulnerabilities in PHP

First seen 27 Oct 2026, 12:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 27, 2026 at 12:44 UTC
  • •CVE-2026-109618 and CVE-2026-109619 allow RCE in PHP versions 8.4.x and earlier.
  • •Active exploitation confirmed; CISA added these vulnerabilities to its KEV list.
  • •Patches are available for affected PHP versions; immediate application is recommended.

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were discovered in PHP, affecting versions 8.4.x and earlier. The flaws allow remote code execution (RCE) through improperly controlled sequential memory allocation, with confirmed. The vulnerabilities were published on October 21, 2026, and added to the CISA KEV list on October 26, 2026, indicating ongoing exploitation. Proof-of-concept (PoC) code was released publicly for CVE-2026-109619 on the same day as its publication. Attackers can exploit these vulnerabilities using various methods, including session injection and memory corruption techniques. PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 have patches available. Security professionals are urged to apply these updates immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
Two critical RCE vulnerabilities in PHP were disclosed, affecting multiple versions.
Sploitus
2026-10-24
First public PoC for CVE-2026-109619
Proof-of-concept code for CVE-2026-109619 was released, demonstrating the exploit.
Sploitus
2026-10-24
Public exploit for CVE-2026-115560 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-26
CISA adds vulnerabilities to KEV list
CISA confirmed active exploitation of the vulnerabilities and added them to its KEV catalog.
Sploitus

More articles in this cluster (3)

Following this threat?

Track LiteSpeed and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 4

Common questions

Which PHP versions are affected?
PHP versions 8.4.x and earlier are affected by these vulnerabilities.
What is the current exploitation status?
Active exploitation of these vulnerabilities has been confirmed, with CISA adding them to its KEV list.
What should I do to protect my systems?
Apply the latest patches for PHP immediately to mitigate the risks associated with these vulnerabilities.