(Reliable)? php2shell exploitability, (Fri, Oct 23rd)
2026-10-25T07:23:41Z•f5efadcfd007a9adb5dcba4cfec59341aa44c5865c0249d368bed7c03d49b94e
CVE-2026-109618CVE-2026-109619AI securityDWGInfocon YellowPHPSANS ISCVBAYARAearly exploitationproof of conceptremote code executionweb application security
What happened
SANS Internet Storm Center coverage highlights a critical PHP vulnerability campaign in October 2026 involving CVE-2026-109618 and CVE-2026-109619. The issue reportedly had a CVSS score of 9.4, widespread PHP exposure, and early proof-of-concept exploits before patches were available, prompting an Infocon Yellow alert. Follow-up reporting discussed exploitability and a return to normal operations. The feed also includes unrelated content on malicious or orphaned VBA projects in DWG files and AI agent security.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- f5efadcfd007a9adb5dcba4cfec59341aa44c5865c0249d368bed7c03d49b94e
- Enrichment time
- 2026-10-25T07:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.