Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

2026-10-21T20:51:31Z•51230f6fecfd9ab1f45615b980fcecb3f33b027f6386eebac6885e3ac8b1b481

CVE-2026-109618CVE-2026-109619AI-assisted attacksBRONZE SANDCASTLEConnectWise Cloud BackupDLL sideloadingEntra IDMeterpreterMicrosoft GraphPHPcredential theftcross-tenant token abuseidentity intrusionlateral movementprivilege escalationproof-of-concept exploitweb application exploitation

Open source link →

What happened

Sophos reports a proof-of-concept exploit for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Other feed items describe AI-assisted web application intrusions, modified Meterpreter shells deployed via DLL sideloading by BRONZE SANDCASTLE, identity reconnaissance, and abuse of a ConnectWise Cloud Backup Entra application to obtain Microsoft Graph tokens across tenants.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: sophos_news
Record identifier: 51230f6fecfd9ab1f45615b980fcecb3f33b027f6386eebac6885e3ac8b1b481
Enrichment time: 2026-10-21T20:51:31Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records