Vendor
PHP
- First Reported
- Oct 20, 2026
- Latest Reported
- Oct 21, 2026
Reported Context (11)
- PHP shipped an out-of-cycle security release on October 21, 2026, for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which its security team rated CVSS v4.0 9.2 (Critical). PHP Patches Two Critical Unauthenticated RCE Flaws in Core
- in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking PHP Releases Emergency Fixes for PHP2Shell Vulnerabilities Amid Early Attack Reports
- On October 20, 2026, the PHP security team published a preliminary notice regarding an upcoming emergency release that addresses two critical vulnerabilities (both rated 9.2 on the CVSS scale). PHP Releases Emergency Patches for Two Critical Unauthenticated RCE Vulnerabilities
- PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP PHP Patches Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
- Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to take Wiz Researchers Detail PHP Memory-Safety Flaws Enabling Unauthenticated RCE
CVE (2)
People (11)
MITRE ATT&CK (17)
Vendors (11)
Products (19)
Tools (8)
Industries (1)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.