Skip to content
Critical PHP Vulnerabilities Exploited Before Public Disclosure

Critical PHP Vulnerabilities Exploited Before Public Disclosure

First seen 21 Oct 2026, 17:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 10:58 UTC
  • •CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE with a CVSS score of 9.2.
  • •Exploitation attempts were detected four days before the vulnerabilities were publicly disclosed.
  • •Patches were released on October 21, 2026, but exploitation continued immediately after.

Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both vulnerabilities allow unauthenticated remote code execution (RCE) and have a CVSS score of 9.2. The attack vector involves the `session.upload_progress` feature in PHP, which can be manipulated to execute arbitrary code. Patches were released on October 21, 2026, but exploitation attempts continued shortly after the fixes were made public. The vulnerabilities affect multiple PHP versions, including those that are no longer supported. Organizations are urged to apply the patches immediately and review their systems for potential exposure.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 6h ago How this analysis works

Timeline

2026-06-04
CVE-2026-10961 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-17
First exploitation attempt detected
Amazon detected attempts to exploit PHP2Shell vulnerabilities in its MadPot honeypot network.
Techtimes
2026-10-21
PHP vulnerabilities publicly disclosed
CVE-2026-109618 and CVE-2026-109619 were disclosed and patches released by PHP.
Sploitus
2026-10-21
Exploitation attempts observed post-disclosure
Further exploitation attempts were detected by Amazon shortly after the vulnerabilities were disclosed.
aws.amazon.com
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (45)

Following this threat?

Track Potassium, Mirai and Amazon in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (46)

1 / 4

Common questions

Which PHP versions are affected?
PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are patched; earlier versions are vulnerable.
Is there confirmed exploitation in the wild?
Yes, Amazon reported active exploitation attempts starting on October 17, 2026.
What immediate actions should I take?
Apply the latest PHP patches and review your systems for potential vulnerabilities.