Loading vulnerability…
CVE-2026-109618 is a critical remote code execution vulnerability in PHP core, reportedly assigned a CVSS v4.0 score of 9.2. watchTowr confirmed reproducing the vulnerability but withheld technical details pending patch availability. The root cause, vulnerable functions, affected configurations, and authoritative affected-version range have not been disclosed. Claims that the flaw affects PHP 5 onward remain unconfirmed. No public proof of concept or confirmed exploitation in the wild was identified before the scheduled security release.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
One of two embargoed PHP remote code execution vulnerabilities reportedly affecting PHP 5.4 and later, each rated CVSS v4.0 9.2. The article says exploitation targets PHP before application code executes. A leaked screenshot shows a purported exploit tool, PHP2Shell, but does not establish public exploit-code availability or observed attacks. Official fixes are scheduled for October 21, 2026, at 14:00 UTC, potentially earlier if technical details become public or attacks begin. Only PHP 8.2 and later will receive official fixes. Suggested temporary session-configuration mitigations are explicitly not guaranteed; strict session mode provides no protection where the session handler lacks the required session-ID validation.
One of two reported critical PHP core RCE vulnerabilities prompting an accelerated security release scheduled for October 21, 2026 at 14:00 UTC. Researchers report successful reproduction, but no public exploit or technical details are available. The official affected-version list is pending; claims that PHP 5 through 8 are affected remain unconfirmed. The content reports no observed in-the-wild exploitation.
A reported critical PHP remote code execution vulnerability rated CVSS 9.2. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with PHP process privileges, potentially compromising applications and servers. Technical details and affected versions remain unconfirmed; claims that PHP 5.4.0 and later are affected are explicitly unverified. A security release is scheduled for October 21, 2026, after the reference date.
Described as a remote code execution vulnerability in PHP. The provided content does not identify affected versions, exploitation prerequisites, or confirmed fixes.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.