News
cybersecurity Optiv Launches CyberBOT Cybersecurity Awareness Training Program - Dark Reading vulnerability USN-8948-2: PHP vulnerabilities - Ubuntu Security Notices cybersecurity LiteLLM 1.107.0 Compromised With A RAT InfoStealer - OX Security cybersecurity Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk - Dark Reading cybersecurity Widespread PHP Flaw May Cause Many Site Outages Today - Krebs on Security threat-intel CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP - Rapid7 Emergent Threat Response cybersecurity PHP 8.5.12 Fixes Critical Flaws That Could Let Hackers Take Over Servers Without Login - CyberPress cybersecurity High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 - SecurityWeek cybersecurity ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire - Wired Security vulnerability PHP Remote Code Execution (“PHP2Shell” CVE-2026-109618 & CVE-2026-109619) - watchTowr Intelligence cybersecurity CVE-2026-109618 & CVE-2026-109619: Two Vulnerabilities Allow Unauthenticated RCE in PHP - OX Security cybersecurity PHP ships emergency patches for critical PHP2Shell flaws - BleepingComputer cybersecurity ClickFix has never been bigger, and AI tools are its most convincing lure yet - BleepingComputer cybersecurity PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge - The Hacker News cybersecurity AI Guardrails Aren’t Stopping Criminal Hackers - Wired Security
1 / 15
All news ›
Threat Intel

CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Rapid7 Emergent Threat Response ·

Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges. CVE CVSSv4 Description CVE-2026-109618 9.2 (Critical) RCE via OOM corruption CVE-2026-109619 9.2 (Critical) RCE via stale global state All installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The vendor considers mod_php the highest risk because exploitation can succeed before any application code runs. The advisories report that a successful RCE exploit was developed during research, including achieving RCE against Apache mod_php and PHP-FPM through different attack paths. As of October 21, 2026, there are multiple in

Continue on Rapid7 Emergent Threat Response ↗ ‹ All news Get the newsletter

The summary and image come from Rapid7 Emergent Threat Response; the image is shown from their website.