Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
2026-10-22T01:23:40Z•bc4d953f23688a8cac051d421401dadc30d78c34d633052abe8382dd89844c99
CVE-2026-109618CVE-2026-109619AutoCAD DWGInfoCon YellowPHPPanchanSANS ISCVBA malwarecritical vulnerabilitycryptocurrency miningearly proof-of-concept exploitremote code execution risk
What happened
SANS ISC reports a critical PHP security update involving CVE-2026-109618 and CVE-2026-109619. The issue was assessed at CVSS 9.4, with early proof-of-concept exploits reportedly available before the patch, prompting an InfoCon Yellow due to PHP’s widespread deployment and likely exploitation risk. The feed also references malicious VBA projects embedded in DWG files and Panchan cryptocurrency-mining activity, but provides insufficient detail to associate additional CVEs.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- bc4d953f23688a8cac051d421401dadc30d78c34d633052abe8382dd89844c99
- Enrichment time
- 2026-10-22T01:23:40Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.