Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
2026-10-21T19:23:43Z•a84d6270f8d015bf17f7278960900a1a7917cfa2ac10eb9bea1c11015a1edc82
CVE-2026-109618CVE-2026-109619INFOCON YELLOWPHPSANS ISCcritical vulnerabilitypre-patch exploitation riskproof-of-concept exploitremote code executionweb applications
What happened
SANS ISC reports a critical PHP vulnerability disclosure involving CVE-2026-109618 and CVE-2026-109619. The issue is rated CVSS 9.4, affects widely deployed PHP environments, and had early proof-of-concept exploits available before the vendor patch, prompting an INFOCON YELLOW alert. Organizations should prioritize vendor updates and assess exposure to internet-facing PHP applications.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- a84d6270f8d015bf17f7278960900a1a7917cfa2ac10eb9bea1c11015a1edc82
- Enrichment time
- 2026-10-21T19:23:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.