sign in--:--:--UTC

CVE-2026-109619

exploited in the wild☆ pin

CVSS

9.2

Reports

18

First seen

Oct 20, 2026

Last seen

Oct 21, 2026

Affected product

PHP

Recent reports

Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 enable remote code execution

Canadian Centre AlertsOct 21, 2026 Critical

PHP Foundation reveals critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 discovered in 2024 but delayed for months

The Record (Recorded Future News)Oct 21, 2026 Critical

HKCERT Warns of Critical PHP2Shell Vulnerabilities; Immediate Patching Required

HKCERTOct 21, 2026 Critical

Widespread PHP Zero-Day Vulnerabilities Affecting 70% of Websites; Active Exploitation Detected

KrebsOnSecurityOct 21, 2026 Critical

Critical RCE Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

Kaspersky SecurelistOct 21, 2026 Critical

Two Critical RCEs in PHP Core (php2shell)

Cisco TalosOct 21, 2026 Critical

Hundreds of websites offline as PHP vulnerabilities CVE-2026-109618/109619 trigger global patching scramble

The Record (Recorded Future News)Oct 21, 2026 Critical

PHP releases emergency patches for critical PHP2Shell remote code execution flaws

Bleeping ComputerOct 21, 2026 Critical

Critical PHP RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619

Palo Alto Unit 42Oct 21, 2026 Critical

PHP to Release Emergency Fixes for Two Critical RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

CyberScoopOct 21, 2026 Critical

Critical Vulnerabilities in PHP Require Immediate Patching

CISA AdvisoriesOct 21, 2026 Critical

CrowdStrike Protects Customers from PHP2Shell Critical RCE Vulnerabilities

CrowdStrike BlogOct 21, 2026 Critical

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Huntress BlogOct 21, 2026 High

High Threat Security Alert: Multiple Vulnerabilities in PHP

GovCERT.HKOct 21, 2026 Critical

Proof-of-concept exploit released for critical PHP vulnerabilities

Sophos NewsOct 21, 2026 Critical

PHP2Shell Exploitation: Two Critical PHP Flaws Explained

Recorded Future InsiktOct 21, 2026 Critical

Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

CERT-EU AdvisoriesOct 20, 2026 Critical

PHP warns admins of two critical RCE flaws, emergency patches coming tomorrow

Bleeping ComputerOct 20, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans