HIGHVulnerability
Verified
Global

CISA KEV: PHP Group PHP — PHP Stale Internal Request-State Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

Analysis

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. Added to CISA Known Exploited Vulnerabilities catalog on 2026-10-26. Remediation due: 2026-10-29.

Indicators of Compromise (1)

CVE (1)
CVE-2026-109619
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Oct 26, 2026. Verified by: CISA.

Related Threats

CRITICALVulnerability

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared first on Unit 42 .

CVE-2026-109618CVE-2026-109619
Unit 42 (Palo Alto)
CRITICALSupply Chain

PHP2Shell will persist in enterprise environments for years

Two critical vulnerabilities were announced last week in PHP , the internet’s most widely used web application runtime, and they came with the familiar warning to patch immediately. But CISOs will have to deal with the long tail of these flaws for years due to widespread PHP integration into third-party products with patching cycles customers don’t control. NAS devices, firewalls, VPN gateways, pr

CVE-2026-109618CVE-2026-109619
CSO Online
CRITICALVulnerability

PHP2Shell: What to know about two critical PHP flaws

Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes

CVE-2026-109618CVE-2026-109619
WeLiveSecurity (ESET)