(Reliable)? php2shell exploitability, (Fri, Oct 23rd)
2026-10-24T07:23:40Z•c04b12dae607b8445a51bf65d59761076646e90f8cc93cc767fa8a2ff6534eaa
CVE-2026-109618CVE-2026-109619Infocon YellowPHPSANS ISCcritical vulnerabilityearly exploitationpatch managementproof of concept exploitremote code executionweb application security
What happened
SANS ISC reported a critical PHP vulnerability cluster, CVE-2026-109618 and CVE-2026-109619, with a stated CVSS score of 9.4 and early proof-of-concept exploits available before patches. The issue was considered broadly impactful because of PHP’s widespread deployment and prompted an Infocon Yellow alert. Follow-up reporting discussed exploitability and a return to normal operations after the vendor update.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- c04b12dae607b8445a51bf65d59761076646e90f8cc93cc767fa8a2ff6534eaa
- Enrichment time
- 2026-10-24T07:23:40Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.