News
cybersecurity Optiv Launches CyberBOT Cybersecurity Awareness Training Program - Dark Reading vulnerability USN-8948-2: PHP vulnerabilities - Ubuntu Security Notices cybersecurity LiteLLM 1.107.0 Compromised With A RAT InfoStealer - OX Security cybersecurity Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk - Dark Reading cybersecurity Widespread PHP Flaw May Cause Many Site Outages Today - Krebs on Security threat-intel CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP - Rapid7 Emergent Threat Response cybersecurity PHP 8.5.12 Fixes Critical Flaws That Could Let Hackers Take Over Servers Without Login - CyberPress cybersecurity High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 - SecurityWeek cybersecurity ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire - Wired Security vulnerability PHP Remote Code Execution (“PHP2Shell” CVE-2026-109618 & CVE-2026-109619) - watchTowr Intelligence cybersecurity CVE-2026-109618 & CVE-2026-109619: Two Vulnerabilities Allow Unauthenticated RCE in PHP - OX Security cybersecurity PHP ships emergency patches for critical PHP2Shell flaws - BleepingComputer cybersecurity ClickFix has never been bigger, and AI tools are its most convincing lure yet - BleepingComputer cybersecurity PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge - The Hacker News cybersecurity AI Guardrails Aren’t Stopping Criminal Hackers - Wired Security
1 / 15
All news ›
Cybersecurity

CVE-2026-109618 & CVE-2026-109619: Two Vulnerabilities Allow Unauthenticated RCE in PHP

OX Security ·

Two critical PHP vulnerabilities, collectively dubbed php2shell, were disclosed on October 20, 2026. Left unpatched, these flaws allow unauthenticated remote attackers to gain full code execution on virtually any publicly accessible PHP instance. The issues have been officially resolved in PHP versions 8.2.35, 8.3.36, 8.4.27, 8.5.12. TL;DR On October 21, 2026, the PHP core team […] The post CVE-2026-109618 & CVE-2026-109619: Two Vulnerabilities Allow Unauthenticated RCE in PHP appeared first on OX Security .

Continue on OX Security ↗ ‹ All news Get the newsletter

The summary and image come from OX Security; the image is shown from their website.