News
cybersecurity Critical security issue affecting PHP - NCSC UK threat-intel Researchers Uncover GhostShares Flaw That Makes Meta Muse AI Conversations Easy to Find - GBHackers cybersecurity She Was the DEA’s Premier Crypto Detective. The Clues Led Straight to Her Own Family - Wired Security cybersecurity Google Chrome Update Fixes 353 Security Vulnerabilities, Including 6 Critical Flaws - CyberPress threat-intel Russian Hackers Steal Credentials and Open Secret SSH Tunnel Into NATO Defense Firm’s Network - GBHackers threat-intel Critical Fortinet FortiSIEM RCE Vulnerability Gets Public PoC Exploit, Allowing Unauthenticated Attacks - GBHackers cybersecurity PHP CVE-2026-109618 & CVE-2026-109619: What to Do Before the Details Drop - OX Security cybersecurity Critical Fortinet FortiSIEM RCE Vulnerability Gets Public Exploit Code - CyberPress cybersecurity Oracle Releases Massive Security Update for Fusion Middleware and E-Business Suite - CyberPress threat-intel Oracle Releases 1,295 Security Patches to Fix Critical Vulnerabilities Across Multiple Products - GBHackers cybersecurity Chinese Espionage Hackers Use Modified Meterpreter Malware to Target Organizations in Asia and Africa - CyberPress threat-intel Apache Tomcat Security Flaws Allow Attackers to Bypass Authentication and Expose User Data - GBHackers vulnerability php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities - Tenable Security Research cybersecurity Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites - The Hacker News ai Eliminating traffic deaths - MIT Technology Review
1 / 15
All news ›
Cybersecurity

PHP Remote Code Execution FAQ: CVE-2026-109618 | watchTowr

Pro CISO ·

A report circulating on social media claims that two PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could let attackers run their own code on affected servers. The report says they affect every PHP version from PHP 5 onward, but no official vendor advisory has confirmed this, and no fixed version exists yet. Organizations running PHP in production should monitor official PHP security channels and be ready to update once a patch is released. As of October 21, 2026, no exploitation in the wild has been reported.

Continue on Pro CISO ↗ ‹ All news Get the newsletter

The summary and image come from Pro CISO; the image is shown from their website.