🛡️ CVE-2026-109618

The items that name it 53

• PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
  articleas cves2026-10-30
• What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained
  articleas cves2026-10-29
• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)
  advisoryas cves2026-10-29
• CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
  articleas cves2026-10-29
• Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
  articleas cves2026-10-29It is written here as CVE-2026-109618: PHP2Shell vulnerability that affects Junos OS, but not in an exploitable way, according to Juniper Networks.
• Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster
  articleas cves2026-10-29It is written here as CVE-2026-109618 (first of two PHP2Shell vulnerabilities; IDs leaked on October 20, 2026).

  first of two PHP2Shell vulnerabilities; IDs leaked on October 20, 2026

• China-Linked Hackers Exploit PHP2Shell to Root Firewalls
  articleas cves2026-10-28
• PHP2Shell: Exploitation Attempts and Remediation Trends
  articleas cves2026-10-27
• Introducing the Cloudflare PHP Capture the Flag challenge
  articleas cves2026-10-27
• How to patch PHP2Shell with free Aikido Images
  articleas cves2026-10-26It is written here as CVE-2026-109618 (PHP2Shell, critical unauthenticated RCE in PHP, CVSS v4.0 score 9.2).

  PHP2Shell, critical unauthenticated RCE in PHP, CVSS v4.0 score 9.2

• CISA Adds Two Known Exploited Vulnerabilities to Catalog
  advisoryas cves2026-10-26It is written here as CVE-2026-109618 (PHP Memory Corruption Vulnerability).

  PHP Memory Corruption Vulnerability

• PHP2Shell: From the attacker’s perspective
  writeupas cves2026-10-26It is written here as CVE-2026-109618: leaves PHP's internal state corrupted when its memory limit is reached, allowing attackers to hijack execution during cleanup.
• Industrial Vendors Check Products for PHP2Shell Vulnerabilities
  articleas cves2026-10-26It is written here as CVE-2026-109618 (PHP2Shell, critical PHP engine flaw allowing unauthenticated remote code execution).

  PHP2Shell, critical PHP engine flaw allowing unauthenticated remote code execution

• PHP2Shell Exploitation Moves From Probes to Working Shells
  articleas cves2026-10-26It is written here as CVE-2026-109618: PHP2Shell flaw, critical, allows unauthenticated remote code execution; Adel Karimi's honeypot activity is consistent with its exploitation.
• Everything, everywhere, all at once… the week software broke | Endor Labs
  articleas cves2026-10-24It is written here as CVE-2026-109618: critical PHP bug that can let an attacker run code on a server without logging in (PHP2Shell).

  PHP2Shell

• CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available
  advisoryas cves2026-10-23
• PHP2Shell: What This Week Tells Us About the Web We Built
  articleas classification.key entities2026-10-23
• Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
  articleas classification.key entities2026-10-23
• Marcus Hutchins (@MalwareTechBlog) on X
  threadas cves2026-10-23
• PHP2Shell Exposure Depends on More Than Whether You Use PHP
  articleas cves2026-10-22
• Tech and Security Companies Respond to PHP2Shell Vulnerabilities
  articleas classification.key entities2026-10-22
• Paul Dragoonis (@dr4goonis) on X
  threadas cves2026-10-22It is written here as CVE-2026-109618 (PHP, Critical: Out-of-Memory Heap Corruption).

  PHP, Critical: Out-of-Memory Heap Corruption

• PHP2Shell Exploitation Started Days Before Patches
  articleas cves2026-10-22It is written here as CVE-2026-109618 (PHP2Shell, critical RCE in PHP; patched October 21, 2026).

  PHP2Shell, critical RCE in PHP; patched October 21, 2026

• [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
  articleas classification.key entities2026-10-22
• [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
  articleas cves2026-10-22It is written here as CVE-2026-109618 (PHP2Shell, PHP-engine memory-corruption flaw in handling of out-of-memory conditions and fatal errors).

  PHP2Shell, PHP-engine memory-corruption flaw in handling of out-of-memory conditions and fatal errors

• PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now
  advisoryas cves2026-10-22It is written here as CVE-2026-109618: PHP RCE via out-of-memory corruption, CVSS v4.0 9.2, unauthenticated; Snyk advisory SNYK-UNMANAGED-PHP-21347795.
• Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
  articleas cves2026-10-22It is written here as CVE-2026-109618: PHP2Shell, critical unauthenticated RCE in the PHP core runtime, CVSS v4.0 9.2; out-of-memory memory corruption during multipart/form-data processing; PHP advisory GHSA-w8hw-w9fx-j79w.
• There isn't an easy exploit for this PHP vulnerability
  articleas cves2026-10-21It is written here as CVE-2026-109618 (named in the repository title eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC).

  named in the repository title eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC

• Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
  articleas cves2026-10-21
• PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
  advisoryas classification.key entities2026-10-21
• PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
  articleas classification.key entities2026-10-21
• Remotely exploitable PHP bug found on 70% of world’s websites
  articleas cves2026-10-21
• PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
  articleas cves2026-10-21It is written here as CVE-2026-109618 (out-of-memory (OOM) corruption, part of PHP2Shell, CVSS 9.2, unauthenticated RCE confirmed on Apache with mod_php).

  out-of-memory (OOM

• PHP2Shell: Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) | Endor Labs
  advisoryas cves2026-10-21
• Today's PHP security release, and how we're strengthening security
  articleas classification.key entities2026-10-21
• PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out
  articleas cves2026-10-21It is written here as CVE-2026-109618: PHP flaw rated CVSSv4 9.2, unauthenticated remote code execution; occurs when PHP runs out of memory mid-request and later treats the half-built data as finished.
• PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
  articleas classification.key entities2026-10-21
• Two critical RCEs in PHP core
  advisoryas classification.key entities2026-10-21
• PHP Remote Code Execution ("PHP2Shell" CVE-2026-109618 & CVE-2026-109619)
  advisoryas classification.key entities2026-10-21
• Cloudflare deploys protections against php2shell vulnerability
  articleas classification.key entities2026-10-21
• Critical PHP “PHP2Shell” RCE Vulnerabilities Allow Unauthenticated Remote Code Execution (CVSS 9.2)
  advisoryas cves2026-10-21It is written here as CVE-2026-109618 (CVSS v4.0 9.2; PHP2Shell, unauthenticated RCE in the PHP core runtime; reproduced by watchTowr).

  CVSS v4.0 9.2; PHP2Shell, unauthenticated RCE in the PHP core runtime; reproduced by watchTowr

• PHP 8.2.35
  advisoryas cves2026-10-21
• eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
  repoas cves2026-10-21

  Pre-auth remote code execution in PHP core via a heap use-after-free in the session upload progress handler (php_session_rfc1867_callback in ext/session/session.c). CVSS v4.0 score 9.2 (Critical). Reproduced by watchTowr. Demonstrated by a fully automated remote exploit (poc_109618.py) that leaks he

• ikow/php2shell-poc
  repoas cves2026-10-21It is written here as CVE-2026-109618 (GHSA-w8hw-w9fx-j79w).

  GHSA-w8hw-w9fx-j79w

• PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
  articleas cves2026-10-21
• Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
  advisoryas classification.key entities2026-10-21
• Critical vulnerabilities in PHP (PHP2SHELL)
  advisoryas cves2026-10-21It is written here as CVE-2026-109618: critical remote code execution vulnerability in PHP, CVSS v4.0 score 9.2. Fix scheduled for release at 14:00 UTC on October 21, 2026..
• PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
  writeupas cves2026-10-21
• Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)
  advisoryas cves2026-10-20
• Rekt - News or Hype?
  articleas cvesIt is written here as CVE-2026-109618 (PHP, rated 9.2, out-of-memory handling can leave internal request data partially initialized; confirmed and patched by PHP on October 21).

  PHP, rated 9.2, out-of-memory handling can leave internal request data partially initialized; confirmed and patched by PHP on October 21

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
  advisoryas cvesIt is written here as CVE-2026-109618: critical unauthenticated remote code execution in PHP, known as "php2shell"; CISA alert dated 21 October 2026, updated 23 October 2026.
• PHP2Shell: pre-auth RCE via PHP memory-limit fatal errors (CVE-2026-109618/109619)
  writeupas cves
• Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal
  articleas cvesIt is written here as CVE-2026-109618 (critical, CVSS v4.0 9.2, PHP session.upload_progress feature; fixed in out-of-band PHP security release of October 21, 2026 at 14:00 UTC).

  critical, CVSS v4.0 9.2, PHP session.upload_progress feature; fixed in out-of-band PHP security release of October 21, 2026 at 14:00 UTC