CVE-2026-109618Vulnerability
Reported by 36 independent sources · first reported by INCIBE-CERT · last reported
Last reported yesterday
What the reports say
74 reports · the newest 20, newest first · the exact sentence from each-
There's a third PHP2Shell bug, but it won't get an emergency fix“Those, of course, are CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell.”
-
PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches“On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests.”
-
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge“PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical bugs in the PHP engine that can be exploited for unauthenticated remote code execution.”
-
PHP2Shell: Failed Requests, Memory Corruption and Remote Code Execution“CVE-2026-109618”
-
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches“It follows the October 21 emergency release that fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which let an attacker without an account run code on a server.”
-
PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet“On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests.”
-
Impacto de vulnerabilidades críticas de PHP en productos de QNAP“CVE-2026-109618: una petición puede agotar la memoria mientras sus datos están parcialmente inicializados.”
-
Impacto de vulnerabilidades críticas de PHP en productos de Tenable“CVE-2026-109618: la gestión incorrecta del agotamiento de memoria puede dejar datos internos de una petición PHP sin inicializar.”
-
Impacto de vulnerabilidades críticas de PHP en productos de Mitel“CVE-2026-109618: un error al gestionar el agotamiento de memoria puede dejar estructuras de una petición PHP parcialmente inicializadas.”
-
Impacto de vulnerabilidades críticas de PHP en productos de Palo Alto Networks“CVE-2026-109618: la gestión del agotamiento de memoria puede dejar datos de una petición PHP sin inicializar.”
-
Impacto de vulnerabilidades críticas de PHP en productos de Synology“CVE-2026-109618: el agotamiento de memoria durante una petición puede dejar estructuras internas de PHP parcialmente inicializadas.”
-
Impacto de vulnerabilidades críticas de PHP en productos de Cisco“CVE-2026-109618: la gestión incorrecta de errores por falta de memoria puede dejar datos internos de una petición PHP en un estado inválido y permitir la ejecución remota de código.”
-
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware“The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests.”
-
Multiples vulnérabilités dans les produits Tenable (23 octobre 2026)“Référence CVE CVE-2026-109618”
-
Multiples vulnérabilités dans les produits HPE Aruba Networking (23 octobre 2026)“Référence CVE CVE-2026-109618”
-
The adversary economy: How threat actors are reacting to PHP2Shell“20, 2026, two critical unauthenticated remote code execution vulnerabilities in PHP were publicly disclosed: CVE-2026-109618 (OOM Corruption) and CVE-2026-109619 (Stale Global State), each carrying a CVSS v4.0 score of 9.2.”
-
PHP2Shell exploit bypasses protections designed to stop remote code execution“Vulncheck's exploit targets CVE-2026-109618, a critical, out-of-memory corruption bug that leads to remote code execution (RCE) in PHP, and part of the PHP2Shell pair alongside CVE-2026-109619.”
-
PHP2Shell Exposure Depends on More Than Whether You Use PHP“Disclaimer: This article is not a primer on how the CVEs (CVE-2026-109618/CVE-2026-109619) work.”
-
The Current Landscape of OAuth Attacks“Next: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619”
-
PHP2Shell Exploit Tooling Found on Exposed Attacker Server“Our main FAQ blog, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), covers the flaws, fixed versions, and remediation.”
Indicators reported together
named in the same reports- hunt[.]ioin 2 reports
- 206.188.197[.]105in 2 reports
- 107.189.14[.]87in 1 report
- 85.11.167[.]243in 1 report
- 45.198.224[.]169in 1 report
- 134.199.154[.]64in 1 report
- 217.60.242[.]76in 1 report
- 92.118.112[.]100in 1 report
- thunder.godofthunder[.]stin 1 report
- 45.88.138[.]44in 1 report
- 102.210.149[.]166in 1 report
- 122.10.110[.]72in 1 report
- 122.10.17[.]49in 1 report
- 58.221.60[.]160in 1 report
- 41.223.30[.]7in 1 report
- 157.230.117[.]70in 1 report
- 104.219.251[.]31in 1 report
- 107.150.31[.]151in 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2026-109619, CVE-2026-115560
Thanks — we review every report.