CVE-2026-109618
AI description
CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.
- Description
- -
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
35
PHP: Upcoming Critical Security Release PHP’s security team has announced an upcoming release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. Public reporting identifies the issues as CVE-2026-109618 and CVE-2026-109619. Technical details and https://t.c
@secpoint
20 Oct 2026
163 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
About CVE-2026-109618 and CVE-2026-109619, the PHP RCE. The vulnerability is in the PHP's session upload progress path. It was introduced in PHP 5.4, enabled by default and process multipart data before application code. Read below for more info.
@rina4_tot
20 Oct 2026
30779 Impressions
15 Retweets
270 Likes
155 Bookmarks
5 Replies
2 Quotes
Two critical PHP RCEs leaked before the embargo. watchTowr and Previdian both reproduced them. Patches are live now. CVE-2026-109618 and CVE-2026-109619. CVSS 9.2 officially. If you run PHP in production, you might want to start looking at this
@r007User
20 Oct 2026
198 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
PHP Remote Code Execution (CVE-2026-109618 & CVE-2026-109619) Information about two new remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS v3.1 10 / 10), has leaked ahead of their coordinated disclosure, and security firm
@bcs_erictaylor
20 Oct 2026
21413 Impressions
39 Retweets
270 Likes
151 Bookmarks
1 Reply
8 Quotes
PHPにおけるRCEの脆弱性（CVE-2026-109618 / CVE-2026-109619） https://t.co/CMW64AcyeY
@nxf_owl
20 Oct 2026
226 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
1 Quote
I'm only monitoring the situation! #php #CVE-2026-109618 #CVE-2026-109619 Will post updates if I can, but I might be too busy to do so. https://t.co/uqtWWi2oE5
@CisoDiagonal
20 Oct 2026
294 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
Two critical PHP zero-days are about to drop. CVE-2026-109618 & CVE-2026-109619 are reportedly RCE vulnerabilities, with PHP officially rating both CVSS 9.2. No technical details or workaround yet. Security updates are expected today. If you run PHP in production — be re
@UpwindMDR
20 Oct 2026
704 Impressions
0 Retweets
3 Likes
2 Bookmarks
0 Replies
0 Quotes
PHP(※１)において深刻度の高いRCE(※２)ゼロデイ脆弱性が見つかったとの話。 https://t.co/xsxOkIVtA4 CVE予約番号は CVE-2026-109618 CVE-2026-109619 (PHP 5以降の全バージョンが影響受けるがパッチは最新版8のみ提供との噂)
@ken_sugar
20 Oct 2026
500 Impressions
1 Retweet
0 Likes
0 Bookmarks
1 Reply
3 Quotes
A w środy nie chodziliśmy na kremówki, bo łataliśmy PHP. CVE-2026-109618 i CVE-2026-109619. Rzekomo RCE w podstawowym kodzie. https://t.co/y1CAtI7yAk
@Zaufana3Strona
20 Oct 2026
376 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
A w czwartki nie chodziliśmy na kremówki, bo łataliśmy PHP. CVE-2026-109618 i CVE-2026-109619. Rzekomo RCE w podstawowym kodzie. https://t.co/3vXapnvovg
@Zaufana3Strona
20 Oct 2026
232 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Embargoed PHP zero-days just leaked. watchTowr confirms 2 remote code execution flaws in PHP are real: CVE-2026-109618 and CVE-2026-109619. Fixes were meant to go public Thursday, 11am ET (5pm Paris). PHP runs ~7 in 10 websites, WordPress included. Is yours ready? https://t.co/
@Hecadium
20 Oct 2026
2 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes