CRITICALVulnerability
Global

PHP2Shell: PHP Patches Two Critical RCE Vulnerabilities, Urges Immediate Updates

·Source: Qualys Blog

Updated:

Executive Summary

Updated: October 21, 2026 PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. Apache mod_php deployments warrant immediate attention: PHP reports a demonstrated exploit that can trigger before application code runs. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 score of 9.2. Cloudflare has repor

Analysis

Updated: October 21, 2026 PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. Apache mod_php deployments warrant immediate attention: PHP reports a demonstrated exploit that can trigger before application code runs. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 score of 9.2. Cloudflare has reported attack […]

Indicators of Compromise (2)

CVE (2)
CVE-2026-109618
NVDMITRE CVE
CVE-2026-109619
NVDMITRE CVE
Source Attribution

Originally published by Qualys Blog on Oct 21, 2026.

Related Threats

MEDIUMVulnerabilityNEW

LSEG to acquire data provider Octus for $3.5bn

The London Stock Exchange (LSEG) has agreed to acquire credit data provider Octus in a cash deal worth $3.535bn.

Finextra
MEDIUMVulnerabilityNEW

PHP2Shell Exploitation Started Days Before Patches

Initial attempts were observed on October 17, and mass activity began shortly after patches were released. The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek .

SecurityWeek
MEDIUMVulnerability

Cloud Security Maturity Lags Despite Widespread Adoption, SANS Warns

Nearly all organizations now run production workloads in the cloud, but a new SANS survey found most have yet to achieve mature cloud security programs

Infosecurity Magazine