Critical PHP flaws CVE-2026-109618 and CVE-2026-109619 now exploited in the wild
CRITICAL · VULNERABILITYCVE-2026-109618redteam/daily · 12 sources
- Severity
- Critical
- Highest CVSS
- 9.2
- Exploited
- Yes
- Sources
- 12
What happened
Two serious security flaws in PHP, a widely used language for running websites, let an attacker with no login take control of affected servers by sending specially crafted web requests. Open-source reporting says the flaws are now being exploited, and the PHP project has released fixed versions. Website operators should update PHP straight away.
Like I’m new · Written by AI from 12 sources · Wrong?
What to do
- Update Paloaltonetworks Pan-os to the fixed version for your release line (fixes CVE-2026-109618): 10.2.7, 11.1.4, 11.2.4, or see the CVE page for other lines.
- Update PHP to the fixed version for your release line (fixes CVE-2026-109618): 8.2.35, 8.3.36, 8.4.27, or see the CVE page for other lines.
- CVE-2026-109618 is being exploited: treat it as urgent.
- Check whether you use Paloaltonetworks Pan-os: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-109618CVSS 9.2ExploitedPHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may r
- CVE-2026-109619CVSS 9.2ExploitedPHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on thi
Full story timeline · 19 updates
- Wed 21 OctoberPHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)Fortinet PSIRT Advisories
- Critical security issue affecting PHPNCSC (UK)
- Cloudflare deploys protections against php2shell vulnerabilityCloudflare Blog (Security)
- CVE-2026-109618 published, CVSS 9.2NVD
- CVE-2026-109619 published, CVSS 9.2NVD
- PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)AWS Security Bulletins
- Thu 22 OctoberVU#763488: Memory corruption vulnerabilities in PHPCERT/CC Vulnerability Notes
- Mon 26 OctoberCVE-2026-109618 added to CISA’s exploited listCISA KEV
- CVE-2026-109619 added to CISA’s exploited listCISA KEV
- PHP Publishes Mitigation Advice for New RCE FlawInfosecurity Magazine
- Tue 27 OctoberCISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code ExecutionThe Hacker News
- Introducing the Cloudflare PHP Capture the Flag challengeCloudflare Blog (Security)
- PHP security advisory (AV26-1070) - Update 1Canadian Centre for Cyber Security
- AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2Canadian Centre for Cyber Security
- Thu 29 OctoberCVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)Palo Alto Networks Security Advisories
- PHP2Shell will persist in enterprise environments for yearsCSO Online
- Fri 30 OctoberPHP2Shell plus Fragnesia: A dangerous new route from web server to rootCSO Online
- php2shell one week later: Why one exploit doesn’t work everywhereTenable Blog
- Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management InterfacesCyber Security News
Who reported · 12 outlets
Fortinet PSIRT AdvisoriesNCSC (UK)Cloudflare Blog (Security)AWS Security BulletinsCERT/CC Vulnerability NotesInfosecurity MagazineThe Hacker NewsCanadian Centre for Cyber SecurityPalo Alto Networks Security AdvisoriesCSO OnlineTenable BlogCyber Security News
Who and what is in it
Products