CRITICALVulnerability
Global

PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now

·Source: Snyk

Updated:

Executive Summary

Two critical flaws in PHP’s request lifecycle can enable unauthenticated remote code execution. Upgrade to a fixed release or install a vendor backport for older versions.

Analysis

Two critical flaws in PHP’s request lifecycle can enable unauthenticated remote code execution. Upgrade to a fixed release or install a vendor backport for older versions.

Indicators of Compromise (2)

CVE (2)
CVE-2026-109618
NVDMITRE CVE
CVE-2026-109619
NVDMITRE CVE
Source Attribution

Originally published by Snyk on Oct 22, 2026.

Related Threats

CRITICALVulnerabilityNEW

Millions of Exploit Attempts Logged Against PHP Servers

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/millions-exploit-attempts-logged-against-php-servers-image_small-6-a-33179.jpg" align=right hspace=4><b>Urgent PHP Patching Advised as Experts See Widespread Exploit-Building Attempts</b><br>Attacks targeting the critical PHP vulnerabilities dubbed PHP2Shell and patched Wednesday are continuing to mount as hundreds of proof-of-con

Bank Info Security
MEDIUMVulnerabilityNEW

How bug bounty sharpens one researcher’s security skills

As Cybersecurity Awareness Month continues, the GitHub Bug Bounty team spotlights @r31n, diving into their research approach, favorite bug classes, and advice for aspiring hackers. The post How bug bounty sharpens one researcher’s security skills appeared first on The GitHub Blog .

GitHub Security Blog
MEDIUMVulnerability

The Current Landscape of OAuth Attacks

Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42 .

Unit 42 (Palo Alto)