Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
2026-10-22T20:51:32Z•0d3a87da91f1c0100ce33edc7fcbba0c9252dcc0d826cc7b34c5097e0da2a9f9
CVE-2026-109618CVE-2026-109619AI governanceAI-assisted attacksBRONZE SANDCASTLEDLL sideloadingMeterpreterMicrosoft Entra IDMicrosoft GraphOAuth token abusePHP vulnerabilitiesServiceNow enumerationcross-tenant attackidentity intrusionincident responseproof-of-concept exploitweb application security
What happened
Sophos security news highlights a proof-of-concept exploit for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, AI-assisted web application intrusion chains, BRONZE SANDCASTLE activity involving DLL sideloading and modified Meterpreter shells, identity reconnaissance and token abuse across Microsoft Entra tenants, and related incident-response and AI-governance developments. The most immediately actionable item is the public PHP exploit proof of concept; the remaining entries provide threat actor, identity abuse, and defensive trend context.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sophos_news
- Record identifier
- 0d3a87da91f1c0100ce33edc7fcbba0c9252dcc0d826cc7b34c5097e0da2a9f9
- Enrichment time
- 2026-10-22T20:51:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.