CRITICALVulnerability
Global

PHP ships emergency patches for critical PHP2Shell flaws

·Source: BleepingComputer

Updated:

Executive Summary

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]

Analysis

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]

Indicators of Compromise (2)

CVE (2)
CVE-2026-109618
NVDMITRE CVE
CVE-2026-109619
NVDMITRE CVE
Source Attribution

Originally published by BleepingComputer on Oct 21, 2026.

Related Threats

MEDIUMVulnerabilityNEW

LSEG to acquire data provider Octus for $3.5bn

The London Stock Exchange (LSEG) has agreed to acquire credit data provider Octus in a cash deal worth $3.535bn.

Finextra
MEDIUMVulnerability

PHP2Shell Exploitation Started Days Before Patches

Initial attempts were observed on October 17, and mass activity began shortly after patches were released. The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek .

SecurityWeek
MEDIUMVulnerability

Cloud Security Maturity Lags Despite Widespread Adoption, SANS Warns

Nearly all organizations now run production workloads in the cloud, but a new SANS survey found most have yet to achieve mature cloud security programs

Infosecurity Magazine