vulnerability
CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch
CriticalCVSS 9.8KEVEPSS 100%
Summary
CISA has issued a warning to federal agencies, urging them to patch two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) due to ongoing exploitation attempts.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data
Also covered by 38 other source(s)
- Multiples vulnérabilités dans PHP (21 octobre 2026)
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
- Critical Vulnerabilities in PHP Require Immediate Patching
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
- PHP2Shell : deux failles critiques menacent les serveurs web
- PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
- PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched
- Two critical RCEs in PHP core
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Widespread PHP Flaw May Cause Many Site Outages Today
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
- PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024
- 'PHP2Shell' Bugs Signal Red Alert for Security Industry
- PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
- PHP2Shell Exploitation Started Days Before Patches
- Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
- Tech and Security Companies Respond to PHP2Shell Vulnerabilities
- New Serious PHP Vulnerabilities Released and Patched
- PHP2Shell puts dozens of UK government services out of service
- Multiples vulnérabilités dans les produits Tenable (23 octobre 2026)
- Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
- URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
- There's a third PHP2Shell bug, but it won't get an emergency fix
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
- Multiples vulnérabilités dans les produits Tenable (26 octobre 2026)
- PHP2Shell: No login, no app code, no warning. What next?
- We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glue
- PHP2Shell: What to know about two critical PHP flaws
- PHP2Shell Exploitation Moves From Probes to Working Shells
- Industrial Vendors Check Products for PHP2Shell Vulnerabilities
- Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
- This is Fine: What NetScaler Zero-Days Tell Us about the New Normal
- CISA confirms PHP2Shell under attack as researchers clock successful exploits