Critical
AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2
Summary coming soon
Our short summary of this story is on its way. Until then, read it at the source below.
Linked
10 sources cover this
- Fortinet PSIRT Advisories · 21 OctPHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)(opens the publisher’s site)
- NCSC (UK) · 21 OctCritical security issue affecting PHP(opens the publisher’s site)
- Cloudflare Blog (Security) · 21 OctCloudflare deploys protections against php2shell vulnerability(opens the publisher’s site)
- AWS Security Bulletins · 21 OctPHP web runtimes (CVE-2026-109618 and CVE-2026-109619)(opens the publisher’s site)
- CERT/CC Vulnerability Notes · 22 OctVU#763488: Memory corruption vulnerabilities in PHP(opens the publisher’s site)
- Infosecurity Magazine · 3dPHP Publishes Mitigation Advice for New RCE Flaw(opens the publisher’s site)
- The Hacker News · 2dCISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution(opens the publisher’s site)
- Cloudflare Blog (Security) · 2dIntroducing the Cloudflare PHP Capture the Flag challenge(opens the publisher’s site)
- Canadian Centre for Cyber Security · 2dPHP security advisory (AV26-1070) - Update 1(opens the publisher’s site)
- Canadian Centre for Cyber Security · 2dAL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2(opens the publisher’s site)
- Palo Alto Networks Security Advisories · 17hCVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)(opens the publisher’s site)
- CSO Online · 14hPHP2Shell will persist in enterprise environments for years(opens the publisher’s site)