Skip to content
RCE Vulnerability Exploited in PHP Environments

RCE Vulnerability Exploited in PHP Environments

First seen 26 Oct 2026, 12:41 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 26, 2026 at 15:12 UTC
  • •35 confirmed shell events linked to a critical RCE vulnerability in PHP.
  • •Exploitation involves memory pressure and disclosure techniques.
  • •Public PoC code exists for CVE-2026-109619 and CVE-2026-109618.

On October 24, 2026, a remote code execution (RCE) vulnerability was confirmed in PHP environments, affecting systems running PHP 8.4.26 under Apache. The exploitation involved 35 confirmed shell events traced back to two IP addresses: 15.204.59.70 and 162.35.99.94. The attack utilized a four-stage multipart chain that included memory pressure and memory disclosure techniques, leveraging known vulnerabilities CVE-2026-109619 and CVE-2026-109618, both published on October 21, 2026. The evidence collected includes detailed HTTP packet captures and logs that correlate with the execution of shell commands. The vulnerability is linked to the use of oversized PHP session IDs, which facilitated memory disclosure. As of now, the exploit is considered active, with public proof-of-concept code available. Organizations running the affected PHP version are urged to assess their exposure and implement mitigations immediately.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109619 published
A critical RCE vulnerability was disclosed with a CVSS score of 9.2, accompanied by a public PoC.
Article 1
2026-10-21
CVE-2026-109618 published
Another critical RCE vulnerability was disclosed, also with a CVSS score of 9.2, and a PoC released on October 23.
Article 1
2026-10-24
Confirmation of RCE exploitation
Evidence of 35 shell events confirmed through packet captures and logs, indicating active exploitation of the vulnerabilities.
Article 2

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 3

Common questions

Which PHP versions are affected?
The vulnerability affects systems running PHP 8.4.26 under Apache.
Is there active exploitation of this vulnerability?
Yes, there is confirmed active exploitation of the vulnerability as evidenced by 35 shell events.
What should organizations do to protect themselves?
Organizations should assess their systems for the affected PHP version and apply mitigations immediately.