PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
2026-10-23T13:23:42Z•9f5755b973f08f2ca91217122a1e291675d002ec7ef0d9df76a7d5dad3e2479d
CVE-2026-109618CVE-2026-109619AI securityDWGPHPPanchanVBAYARAcritical vulnerabilitycryptocurrency miningpatch managementproof-of-concept exploitweb application security
What happened
SANS Internet Storm Center reporting highlights a critical PHP vulnerability disclosure involving CVE-2026-109618 and CVE-2026-109619. The issue was assessed at CVSS 9.4, with early proof-of-concept exploits reportedly available before patches, prompting an elevated InfoCon warning. Organizations using PHP should prioritize vendor updates and monitor for exploitation. The feed also references VBA-enabled DWG file detection, AI agent security, and Panchan cryptocurrency-mining activity.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 9f5755b973f08f2ca91217122a1e291675d002ec7ef0d9df76a7d5dad3e2479d
- Enrichment time
- 2026-10-23T13:23:42Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.