Skip to content
Hackers Exploit PHP Vulnerabilities to Breach 25 Servers, Including U.S. Systems

Hackers Exploit PHP Vulnerabilities to Breach 25 Servers, Including U.S. Systems

First seen 28 Oct 2026, 18:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 19:11 UTC
  • •Hackers exploited PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.
  • •25 servers were breached, including U.S. government-linked systems.
  • •AI tools may have facilitated the attack, but their exact role is unclear.

Hackers breached 25 servers across the U.S., Japan, Taiwan, and South Korea, exploiting critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. The attacks targeted systems linked to an U.S. Government-affiliated organization, allowing unauthorized access to internal network information and authentication credentials. Security researchers from Dream Research reported that AI tools may have played a role in the attack, although the exact involvement remains unclear. The attackers combined the PHP vulnerabilities with another Linux flaw, Fragnesia, to gain full control of the systems. The vulnerabilities were disclosed on October 21, 2026, and were added to the CISA KEV list for on October 26, 2026. The attackers reportedly scanned around 19,000 firewalls before breaching 25 systems. Evidence suggests a possible Chinese connection, but the attackers have not been identified.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
PHP vulnerabilities disclosed
CVE-2026-109618 and CVE-2026-109619 were publicly disclosed, allowing potential exploitation.
Tomsguide
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-26
CVE added to CISA KEV
CVE-2026-109618 and CVE-2026-109619 were added to the CISA KEV list for active exploitation.
Tomsguide

More articles in this cluster (2)

Following this threat?

Track eMudhra and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (30)

1 / 3

Common questions

What vulnerabilities were exploited?
The attackers exploited PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.
Is there evidence of state involvement?
There are indications of a possible Chinese connection, but the attackers have not been identified.
What should organizations do?
Organizations using PHP should prioritize patching the disclosed vulnerabilities and monitor for unusual activity.