SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
31 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-109618 · CVE-2026-109619 · CVSS 9.2

PHP: 2 flaws used in attacks; attackers can run their own code

AFFECTSPHP

OFFICIAL NAMES: RCE via stale global state · RCE via OOM corruption

WHAT IT IS · WEBSITE OR ONLINE STOREIt runs public websites, online stores or the software behind them.

DO THIS FIRSTAsk whoever runs your website or store to update it. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 20 days old, so many systems are likely still unpatched. Ready-made attack tools are public. The severity score is critical (9.2). The exploit prediction score is 100%.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. Ready-made attack tools are public. The confirmation is 16 days old.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ■ CONFIRMED
    NEWEST EVIDENCE · 10 INDEPENDENT SOURCES

    CVE-2026-109619 discussed publicly (CIRCL sighting). CVE-2026-109618 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Attack attempts on CVE-2026-109619 seen by honeypots (Shadowserver via CIRCL). Attack attempts on CVE-2026-109619 seen by honeypots (Shadowserver via CIRCL).

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Exploitation of CVE-2026-109619 reported (CIRCL sighting). Exploitation of CVE-2026-109618 reported (CIRCL sighting).

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-109619 published
  2. EXPLOIT CODE PUBLIC
    Exploit-DB
  3. FIRST ATTACK REPORT
    CIRCL Vulnerability-Lookup sightings
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported on or before the day the flaw was disclosed. CISA listed it 5 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Oct 29, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. OCT 17, 2026
    619 public GitHub repositories claim a proof of concept for CVE-2026-109618
  2. OCT 21, 2026
    Critical security issue affecting PHP
  3. OCT 21, 2026
    PHP releases emergency fixes for 2 critical vulnerabilities
  4. Attack activity. OCT 21, 2026
    CISA Vulnrichment marks CVE-2026-109618 as actively exploited
  5. Attack activity. OCT 21, 2026
    CISA Vulnrichment marks CVE-2026-109619 as actively exploited
  6. OCT 21, 2026
    23 public GitHub repositories claim a proof of concept for CVE-2026-109619
  7. OCT 21, 2026
    PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched
  8. OCT 21, 2026
    Widespread PHP Flaw May Cause Many Site Outages Today
  9. OCT 21, 2026
    Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
  10. Attack activity. OCT 21, 2026
    Exploitation of CVE-2026-109619 reported (CIRCL sighting) (7 reports, latest OCT 27)
  11. Attack activity. OCT 21, 2026
    Exploitation of CVE-2026-109618 reported (CIRCL sighting) (8 reports, latest OCT 27)
  12. OCT 21, 2026
    PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection, OCT 24
  2. [2] nuclei-templates: Nuclei scan template: PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 - Use-After-Free Remote Code Execution, NOV 3
  3. [3] CIRCL Vulnerability-Lookup sightings: CVE-2026-109619 discussed publicly (CIRCL sighting), NOV 10
  4. [4] CIRCL Vulnerability-Lookup sightings: Public proof of concept for CVE-2026-109618 (CIRCL sighting), NOV 10
  5. [5] CIRCL Vulnerability-Lookup sightings: Public proof of concept for CVE-2026-109619 (CIRCL sighting), NOV 10
  6. [6] The Register (security): Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers, OCT 29
  7. [7] The Register (security): CISA confirms PHP2Shell under attack as researchers clock successful exploits, OCT 27
  8. [8] Canadian Centre for Cyber Security: PHP security advisory (AV26-1070) - Update 1, OCT 27
  9. [9] Security Affairs: U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog, OCT 27
  10. [10] The Hacker News: CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution, OCT 26
  11. [11] Security Affairs: PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts, OCT 26
  12. [12] BleepingComputer: PHP2Shell security flaws now sucessfully exploited in the wild, OCT 26
  13. [13] The Register (security): PHP2Shell: No login, no app code, no warning. What next?, OCT 26
  14. [14] CISA Known Exploited Vulnerabilities: PHP Stale Internal Request-State Vulnerability, OCT 25
  15. [15] CISA Known Exploited Vulnerabilities: PHP Memory Corruption Vulnerability, OCT 25
  16. [16] The Hacker News: PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking, OCT 25
  17. [17] Security Affairs: PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches, OCT 23
  18. [18] Canadian Centre for Cyber Security: AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1, OCT 23
  19. [19] The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware, OCT 23
  20. [20] Exploit-DB: Exploit-DB entry: PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE, OCT 21
  21. [21] SANS Internet Storm Center: Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st), OCT 21
  22. [22] Krebs on Security: Widespread PHP Flaw May Cause Many Site Outages Today, OCT 21
  23. [23] PoC-in-GitHub: 23 public GitHub repositories claim a proof of concept for CVE-2026-109619, OCT 21
  24. [24] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-109619 as actively exploited, OCT 21
  25. [25] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-109618 as actively exploited, OCT 21
  26. [26] CyberScoop: PHP releases emergency fixes for 2 critical vulnerabilities, OCT 21
  27. [27] UK NCSC: Critical security issue affecting PHP, OCT 21
  28. [28] PoC-in-GitHub: 619 public GitHub repositories claim a proof of concept for CVE-2026-109618, OCT 17
  29. [29] CIRCL Vulnerability-Lookup sightings: 649 more reports
  30. [30] The Register (security): 6 more reports
  31. [31] Security Affairs: 1 more reports