News
cybersecurity Cloudflare Detects Early Attacks Exploiting Critical PHP Flaws, Deploys WAF Rules - CyberPress threat-intel Cloudflare Warns of Active Exploitation Attempts Against Two Leaked PHP Flaws - GBHackers cybersecurity Critical security issue affecting PHP - NCSC UK threat-intel BRONZE SANDCASTLE Hackers Steal Active Directory Database Using Hidden Windows Backdoors - GBHackers ai Nvidia and Anthropic partner to enhance AI security with OpenShell integration - Crypto Briefing - Anthropic - Claude AI threat-intel Google Chrome 156 Fixes 353 Security Vulnerabilities, Including 6 Critical Flaws - GBHackers cybersecurity PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't - The Hacker News cybersecurity The Harness Is the Hard Part of Agentic Pentesting - The Hacker News cybersecurity Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections - The Hacker News threat-intel Researchers Uncover GhostShares Flaw That Makes Meta Muse AI Conversations Easy to Find - GBHackers cybersecurity She Was the DEA’s Premier Crypto Detective. The Clues Led Straight to Her Own Family - Wired Security cybersecurity Google Chrome Update Fixes 353 Security Vulnerabilities, Including 6 Critical Flaws - CyberPress threat-intel Russian Hackers Steal Credentials and Open Secret SSH Tunnel Into NATO Defense Firm’s Network - GBHackers ai OpenAI, Anthropic, and the Case for Mandatory AI Breach Disclosure - HackerNoon - Anthropic - Claude AI threat-intel Critical Fortinet FortiSIEM RCE Vulnerability Gets Public PoC Exploit, Allowing Unauthenticated Attacks - GBHackers
1 / 15
All news ›
Vulnerability

php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

Tenable Security Research ·

Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclo

Continue on Tenable Security Research ↗ ‹ All news Get the newsletter

The summary and image come from Tenable Security Research; the image is shown from their website.