(Reliable)? php2shell exploitability, (Fri, Oct 23rd)
2026-10-24T19:23:41Z•ec17b54777c1c26d3d094cfac9f467cbad86b81dbc0f6e2583299edd0d954a89
CVE-2026-109618CVE-2026-109619AI-securityDWGPHPVBAYARAcritical-vulnerabilityexploitationphp2shellproof-of-conceptremote-code-execution
What happened
SANS Internet Storm Center reporting from October 2026 highlights a critical PHP vulnerability tracked as CVE-2026-109618 and CVE-2026-109619. The issue carried a reported CVSS score of 9.4, affected widely deployed PHP environments, and had early proof-of-concept exploits available before patch release, prompting an elevated InfoCon status. Follow-up coverage discusses exploitability and returning to normal operations. The feed also includes a YARA rule for detecting orphaned VBA projects in DWG files and commentary on limiting AI-agent capabilities.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- ec17b54777c1c26d3d094cfac9f467cbad86b81dbc0f6e2583299edd0d954a89
- Enrichment time
- 2026-10-24T19:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.