vulnerability

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)

Published 21 Oct 2026, 12:31 UTC · Updated 21 Oct 2026, 12:49 UTC · Source: SANS Internet Storm Center

Medium

Summary

A critical PHP vulnerability (CVE-2026-109618, CVE-2026-109619) has been identified, impacting all PHP versions and leading to the change of the SANS Internet Storm Center’s alert to ‘yellow’. Cloudflare has deployed protections, and other vendors are likely to have implemented similar measures.

Read the full article at SANS Internet Storm Center

Add news.mlab.sh as a preferred source on Google

Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data

Also covered by 3 other source(s)

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert · The Hacker News · 8h ago
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws · SecurityWeek · 6h ago
PHP2Shell : deux failles critiques menacent les serveurs web · ZATAZ · 36m ago

Report an error