🛡️ CVE-2026-109619

The items that name it 51

• PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
  articleas cves2026-10-30
• What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained
  articleas cves2026-10-29
• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)
  advisoryas cves2026-10-29
• CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
  articleas cves2026-10-29
• Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster
  articleas cves2026-10-29It is written here as CVE-2026-109619 (second of two PHP2Shell vulnerabilities; IDs leaked on October 20, 2026).

  second of two PHP2Shell vulnerabilities; IDs leaked on October 20, 2026

• China-Linked Hackers Exploit PHP2Shell to Root Firewalls
  articleas cves2026-10-28
• PHP2Shell: Exploitation Attempts and Remediation Trends
  articleas cves2026-10-27
• Introducing the Cloudflare PHP Capture the Flag challenge
  articleas cves2026-10-27
• How to patch PHP2Shell with free Aikido Images
  articleas cves2026-10-26It is written here as CVE-2026-109619 (PHP2Shell, critical unauthenticated RCE in PHP, CVSS v4.0 score 9.2; one confirmed path is session.upload_progress.enabled).

  PHP2Shell, critical unauthenticated RCE in PHP, CVSS v4.0 score 9.2; one confirmed path is session.upload_progress.enabled

• CISA Adds Two Known Exploited Vulnerabilities to Catalog
  advisoryas cves2026-10-26It is written here as CVE-2026-109619 (PHP Stale Internal Request-State Vulnerability).

  PHP Stale Internal Request-State Vulnerability

• PHP2Shell: From the attacker’s perspective
  writeupas cves2026-10-26It is written here as CVE-2026-109619: causes a double free that exploit chains use to leak memory and defeat ASLR; together with CVE-2026-109618 it can enable unauthenticated code execution and expose secrets.
• Industrial Vendors Check Products for PHP2Shell Vulnerabilities
  articleas cves2026-10-26It is written here as CVE-2026-109619 (PHP2Shell, critical PHP engine flaw allowing unauthenticated remote code execution).

  PHP2Shell, critical PHP engine flaw allowing unauthenticated remote code execution

• PHP2Shell Exploitation Moves From Probes to Working Shells
  articleas cves2026-10-26It is written here as CVE-2026-109619: PHP2Shell flaw, critical, allows unauthenticated remote code execution.
• Everything, everywhere, all at once… the week software broke | Endor Labs
  articleas cves2026-10-24It is written here as CVE-2026-109619: critical PHP bug that can let an attacker run code on a server without logging in (PHP2Shell).

  PHP2Shell

• CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available
  advisoryas cves2026-10-23
• PHP2Shell: What This Week Tells Us About the Web We Built
  articleas cves2026-10-23It is written here as CVE-2026-109619: PHP flaw where global state keeps pointing at request memory after it is freed; CVSS v4 9.2, unauthenticated, can run code and read process memory.
• Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
  articleas cves2026-10-23It is written here as CVE-2026-109619: PHP2Shell critical PHP engine bug allowing unauthenticated remote code execution, CVSS v4.0 score 9.2.
• Marcus Hutchins (@MalwareTechBlog) on X
  threadas cves2026-10-23
• PHP2Shell Exposure Depends on More Than Whether You Use PHP
  articleas cves2026-10-22
• Tech and Security Companies Respond to PHP2Shell Vulnerabilities
  articleas cves2026-10-22It is written here as CVE-2026-109619: critical PHP2Shell bug allowing unauthenticated remote code execution. Red Hat scores it 8.1 versus 9.8 from NVD..
• Paul Dragoonis (@dr4goonis) on X
  threadas cves2026-10-22It is written here as CVE-2026-109619 (PHP, Critical: Stale Global State Use-After-Free).

  PHP, Critical: Stale Global State Use-After-Free

• PHP2Shell Exploitation Started Days Before Patches
  articleas cves2026-10-22It is written here as CVE-2026-109619 (PHP2Shell, critical RCE in PHP; patched October 21, 2026).

  PHP2Shell, critical RCE in PHP; patched October 21, 2026

• [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
  articleas cves2026-10-22It is written here as CVE-2026-109619 (PHP2Shell, second PHP-engine memory-corruption flaw, same root-cause area as CVE-2026-109618).

  PHP2Shell, second PHP-engine memory-corruption flaw, same root-cause area as CVE-2026-109618

• [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
  articleas cves2026-10-22It is written here as CVE-2026-109619 (PHP2Shell, second PHP-engine memory-corruption flaw in the same area).

  PHP2Shell, second PHP-engine memory-corruption flaw in the same area

• PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now
  advisoryas cves2026-10-22It is written here as CVE-2026-109619: PHP RCE via stale global state (cross-request use-after-free in long-lived workers), CVSS v4.0 9.2, unauthenticated; Snyk advisory SNYK-UNMANAGED-PHP-21347796.

  cross-request use-after-free in long-lived workers

• Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
  articleas classification.key entities2026-10-22
• There isn't an easy exploit for this PHP vulnerability
  articleas cves2026-10-21It is written here as CVE-2026-109619 (named in the repository title eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC).

  named in the repository title eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC

• Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
  articleas cves2026-10-21
• PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
  advisoryas classification.key entities2026-10-21
• PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
  articleas cves2026-10-21It is written here as CVE-2026-109619: critical remote code execution vulnerability in PHP, patched in the same emergency releases; the leaked identifiers circulated on October 20, 2026 with an incorrect CVSS score of 10.0.
• Remotely exploitable PHP bug found on 70% of world’s websites
  articleas cves2026-10-21
• PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
  articleas cves2026-10-21It is written here as CVE-2026-109619 (stale global state, part of PHP2Shell, CVSS 9.2, unauthenticated RCE confirmed on Apache with mod_php).

  stale global state, part of PHP2Shell, CVSS 9.2, unauthenticated RCE confirmed on Apache with mod_php

• PHP2Shell: Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) | Endor Labs
  advisoryas cves2026-10-21
• PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out
  articleas cves2026-10-21It is written here as CVE-2026-109619: PHP flaw rated CVSSv4 9.2, unauthenticated remote code execution; leftovers from one visitor's request linger in memory and the next request can trip over them.
• PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
  articleas classification.key entities2026-10-21
• Two critical RCEs in PHP core
  advisoryas cves2026-10-21It is written here as CVE-2026-109619: critical PHP core unauthenticated RCE, CVSS v4.0 score 9.2; a stale internal state is reused after its backing memory has been freed, before normal initialization resets it.
• PHP Remote Code Execution ("PHP2Shell" CVE-2026-109618 & CVE-2026-109619)
  advisoryas classification.key entities2026-10-21
• Cloudflare deploys protections against php2shell vulnerability
  articleas classification.key entities2026-10-21
• Critical PHP “PHP2Shell” RCE Vulnerabilities Allow Unauthenticated Remote Code Execution (CVSS 9.2)
  advisoryas cves2026-10-21It is written here as CVE-2026-109619 (CVSS v4.0 9.2; PHP2Shell, unauthenticated RCE in the PHP core runtime).

  CVSS v4.0 9.2; PHP2Shell, unauthenticated RCE in the PHP core runtime

• PHP 8.2.35
  advisoryas cves2026-10-21
• eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
  repoas cves2026-10-21

  Second of two critical pre-auth RCE vulnerabilities in PHP core, affecting the same session upload progress mechanism as CVE-2026-109618. Collectively referred to as 'php2shell'. CVSS v4.0 score 9.2 (Critical).

• ikow/php2shell-poc
  repoas cves2026-10-21It is written here as CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp).

  GHSA-6wmf-4rv5-p3rp

• PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
  articleas cves2026-10-21
• Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
  advisoryas classification.key entities2026-10-21
• Critical vulnerabilities in PHP (PHP2SHELL)
  advisoryas cves2026-10-21It is written here as CVE-2026-109619: critical remote code execution vulnerability in PHP, CVSS v4.0 score 9.2. Fix scheduled for release at 14:00 UTC on October 21, 2026..
• PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
  writeupas cves2026-10-21
• Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)
  advisoryas cves2026-10-20
• Rekt - News or Hype?
  articleas cvesIt is written here as CVE-2026-109619 (PHP, rated 9.2, stale internal state survives after the memory behind it is freed; confirmed and patched by PHP on October 21).

  PHP, rated 9.2, stale internal state survives after the memory behind it is freed; confirmed and patched by PHP on October 21

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
  advisoryas cvesIt is written here as CVE-2026-109619: critical unauthenticated remote code execution in PHP, known as "php2shell"; CISA alert dated 21 October 2026, updated 23 October 2026.
• PHP2Shell: pre-auth RCE via PHP memory-limit fatal errors (CVE-2026-109618/109619)
  writeupas cves
• Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal
  articleas cvesIt is written here as CVE-2026-109619 (critical, CVSS v4.0 9.2, PHP session.upload_progress feature; fixed in out-of-band PHP security release of October 21, 2026 at 14:00 UTC).

  critical, CVSS v4.0 9.2, PHP session.upload_progress feature; fixed in out-of-band PHP security release of October 21, 2026 at 14:00 UTC