CISA Adds Two Critical PHP Flaws to Actively Exploited Vulnerabilities
CISA has recorded active exploitation of PHP flaws CVE-2026-109618 and CVE-2026-109619. Fixes have been available since October 21 across several supported branches.
Tag CVE-2026-109619
PHP Releases Emergency Fixes for Critical PHP2Shell Flaws as Exploitation Attempts Are Detected
The PHP project fixed two critical vulnerabilities enabling unauthenticated remote code execution. AWS detected exploitation attempts before the fixes were publicly disclosed.
Updated: PHP Releases Fixes for Two Critical Vulnerabilities; Some Websites Temporarily Taken Offline
The PHP project released updates for CVE-2026-109618 and CVE-2026-109619. The flaws may allow unauthenticated remote code execution; during patch deployment, some operators restricted website availability.