{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:27.704Z","products":["php"],"actNowTotal":1,"results":[{"query":"php","matched":1,"actNow":1,"events":[{"id":"early-cve-2026-109618","url":"https://securitythreatpulse.com/events/early-cve-2026-109618","title":"PHP: 2 flaws used in attacks; attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 20 days old, so many systems are likely still unpatched. Ready-made attack tools are public. The severity score is critical (9.2). The exploit prediction score is 100%.","tier":"now","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","Ready-made attack tools are public.","The confirmation is 16 days old."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-109618","CVE-2026-109619"],"vendor":"PHP Group","product":"PHP","affectedProducts":[{"kind":"direct","slug":"php/php","vendor":"PHP","product":"PHP","evidence":["kev","cpe"],"vendorKey":"php","productKey":"php"}],"category":{"id":"website","label":"Website or online store","why":"It runs public websites, online stores or the software behind them.","doThis":"Ask whoever runs your website or store to update it."},"summary":"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory.","cvss":9.2,"epss":0.99999,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-10-26","kevDueDate":"2026-10-29","firstSeenAt":"2026-10-21T23:00:53.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-11T04:03:09.110Z"}]}]}