Critical 9.2
CVE-2026-109618
Leak of PHP2Shell Exploit Exposing Critical PHP Remote Code Execution Vulnerabilities
Vendor / product: PHP
Event date: 2026-10-20
Public PoC: Yes
First tracked by RiskWire: 2026-10-21
Named threat actors
Calif.IO
Sources & citations (35)
- PHP 计划紧急发布两个安全补丁——Ars Technica ua.news · 2026-10-21
- What to know about critical PHP vulnerability threatening Internet tech.yahoo.com · 2026-10-21
- PHP-Sicherheitslücke: Notfall-Patch um 16 Uhr für alle Shops wortfilter.de · 2026-10-21
- PHP срочно выпустит два патча безопасности — Ars Technica ua.news · 2026-10-21
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws securityweek.com · 2026-10-21
- Розробники PHP планують терміново випустити два патчі — Ars Technica ua.news · 2026-10-21
- Две критические дыры в PHP. Готовый эксплойт появился раньше исправлений securitylab.ru · 2026-10-21
- PHP prepares emergency security fixes for two critical flaws as exploit details leak businessupturn.com · 2026-10-21
- Critical PHP RCE Vulnerabilities Could Put Millions of Websites at Risk cyberpress.org · 2026-10-21
- PHP Warns of Two Critical 9.2 Security Vulnerabilities, Urges Users to Prepare for Patches cybersecuritynews.com · 2026-10-21
- PHP maintainers tell Web devs to prepare themselves for critical security patches arstechnica.com · 2026-10-21
- İnternetin temel taşlarından PHP'de kritik açık: Acil yama geliyor donanimhaber.com · 2026-10-21
- PHP va corriger deux vulnérabilités critiques aujourd'hui next.ink · 2026-10-21
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert thehackernews.com · 2026-10-21
- PHP alerta para duas falhas críticas e correções emergenciais cisoadvisor.com.br · 2026-10-20
- Severe PHP Vulnerabilities Prompt Urgent Security Patches news.ssbcrack.com · 2026-10-21
- ثغرات PHP خطيرة: تحديثات أمنية عاجلة swalif.net · 2026-10-21
- PHP: parches de emergencia por 2 fallos críticos ecosistemastartup.com · 2026-10-21
- Vulnerabilități critice în PHP: CERT-EU recomandă actualizări urgente pentru a preveni atacuri RCE goldring.ro · 2026-10-21
- PHP: Zwei kritische RCE-Lücken (CVE-2026-109618 / -109619) Notfall-Release heute 16:00 Uhr administrator.de · 2026-10-21
+15 more sources
References
See CVE-2026-109618 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →