CVE-2026-109818

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

October 23, 2026

Last Seen

October 23, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical PHP2Shell Vulnerabilities Expose Web Servers to RCE72.9

On October 21, 2026, PHP disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively termed PHP2Shell, which allow unauthenticated remote code execution (RCE) through improper memory handling during request processing. Both vulnerabilities received a CVSS score of 9.2,...