CVE-2026-109618

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

October 20, 2026

Last Seen

October 20, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical RCE Vulnerabilities in PHP Confirmed, Patches Coming Soon72.0

PHP's security team confirmed two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 officially, with some reports indicating a CVSS of 10.0. The vulnerabilities affect PHP versions 5 through 8, but only PHP 8.0 and above will receive patches. T...