CRITICALVulnerability
Global

PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): [Updated for CVE-2026-115560]

·Source: Snyk

Updated:

Executive Summary

Two critical flaws in PHP’s request lifecycle can enable unauthenticated remote code execution. Upgrade to a fixed release or install a vendor backport for older versions.

Analysis

Two critical flaws in PHP’s request lifecycle can enable unauthenticated remote code execution. Upgrade to a fixed release or install a vendor backport for older versions.

Indicators of Compromise (3)

CVE (3)
CVE-2026-109618
NVDMITRE CVE
CVE-2026-109619
NVDMITRE CVE
CVE-2026-115560
NVDMITRE CVE
Source Attribution

Originally published by Snyk on Oct 26, 2026.

Related Threats

CRITICALVulnerability

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared first on Unit 42 .

CVE-2026-109618CVE-2026-109619
Unit 42 (Palo Alto)
CRITICALSupply Chain

PHP2Shell will persist in enterprise environments for years

Two critical vulnerabilities were announced last week in PHP , the internet’s most widely used web application runtime, and they came with the familiar warning to patch immediately. But CISOs will have to deal with the long tail of these flaws for years due to widespread PHP integration into third-party products with patching cycles customers don’t control. NAS devices, firewalls, VPN gateways, pr

CVE-2026-109618CVE-2026-109619
CSO Online
MEDIUMVulnerability

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory

CVE-2026-109618
The Hacker News