Vulnerabilities & Exploits
PHP's critical flaws may reach forgotten applications CERT-EU says the PHP Foundation announced on Oct. 20 that a security release for two critical PHP flaws is scheduled for Oct. 21 at 14:00 UTC. The flaws, CVE-2026-109618 and CVE-2026-109619 , reportedly affect PHP 5 and later, but no technical details or fixed versions are public.
Leaked information and the flaws’ CVSS scores point to possible unauthenticated remote code execution (RCE): running code on a server without first logging in. The actual flaw paths remain undisclosed, so neither the attack method nor the exact vulnerable builds can yet be confirmed.
If an organization has internet-facing PHP apps missing from its inventory—especially legacy PHP 5 deployments—it may not know which systems are in scope when fixes arrive. Until PHP publishes the release details, the breadth of exposure remains reported rather than verified.
9 sources · 1h ago
CVE-2026-109618 NVD KEV
CVE-2026-109619 NVD KEV
Timeline Sources Oct 21 SecurityWeek
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution.
original Oct 21 The Hacker News
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
PHP2Shell involves two critical PHP RCE flaws rated CVSS 9.2, with emergency fixes scheduled following a disclosure leak.
original Oct 21 Help Net Security
A critical PHP security release is coming today, so get ready to update! - Help Net Security
A critical PHP security release is due 21 October at 14:00 UTC, fixing two CVSS 9.2 flaws. Here’s what site owners should do to prepare now.
original Part of the PlainSec briefing for 2026-10-21
Every edition of this story: PHP's critical flaws may reach forgotten applications
More from today Vulnerabilities & Exploits
PHP's critical flaws may reach forgotten applications CERT-EU says the PHP Foundation announced on Oct. 20 that a security release for two critical PHP flaws is scheduled for Oct. 21 at 14:00 UTC. The flaws, CVE-2026-109618 and CVE-2026-109619 , reportedly affect PHP 5 and later, but no technical details or fixed versions are public.
Leaked information and the flaws’ CVSS scores point to possible unauthenticated remote code execution (RCE): running code on a server without first logging in. The actual flaw paths remain undisclosed, so neither the attack method nor the exact vulnerable builds can yet be confirmed.
If an organization has internet-facing PHP apps missing from its inventory—especially legacy PHP 5 deployments—it may not know which systems are in scope when fixes arrive. Until PHP publishes the release details, the breadth of exposure remains reported rather than verified.
9 sources · 1h ago
CVE-2026-109618 NVD KEV
CVE-2026-109619 NVD KEV
Timeline Sources Oct 21 SecurityWeek
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution.
original Oct 21 The Hacker News
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
PHP2Shell involves two critical PHP RCE flaws rated CVSS 9.2, with emergency fixes scheduled following a disclosure leak.
original Oct 21 Help Net Security
A critical PHP security release is coming today, so get ready to update! - Help Net Security
A critical PHP security release is due 21 October at 14:00 UTC, fixing two CVSS 9.2 flaws. Here’s what site owners should do to prepare now.
original Part of the PlainSec briefing for 2026-10-21
Every edition of this story: PHP's critical flaws may reach forgotten applications
More from today