Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
2026-10-21T13:23:41Z•34fdd2c9bac375a52bf303a3c30d74f49397cc9126cd494106774ca25d0d4ed2
CVE-2026-109618CVE-2026-109619PHPSANS ISCcritical vulnerabilityearly exploitationinfoCon Yellowpatch managementproof of conceptremote code execution
What happened
SANS Internet Storm Center reported two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with an expected CVSS score of 9.4. Early proof-of-concept exploits were reportedly available before PHP.net’s planned security update, prompting an infoCon YELLOW alert due to PHP’s widespread deployment and potential exploitation risk.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 34fdd2c9bac375a52bf303a3c30d74f49397cc9126cd494106774ca25d0d4ed2
- Enrichment time
- 2026-10-21T13:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.