Covered by 8 sources — first reported by Datadog Security Labs, Oct 21, 00:00 UTC

PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation

MentionsAmazon Web Services Google Google Cloud Kaspersky

SecurityTabs reportupdated 1h agoPHP2Shell: Two critical PHP remote code execution flaws patched, exploitation attempts continue

Coverage

Oct 21, 00:00 UTCDatadog Security Labs
PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
Oct 21, 04:00 UTCHuntress Blog
Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
Oct 21, 14:00 UTCGoogle Cloud Security
Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
Oct 21, 15:18 UTCKaspersky Securelist
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Oct 21, 20:49 UTCUS-CERT / SANS Internet Storm Center
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
Oct 22, 00:50 UTCAWS Security Blog
Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Oct 23, 16:15 UTCCanadian Centre for Cyber Security
AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1
Oct 23, 19:00 UTCPalo Alto Unit 42
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)

Vulnerabilities in this story