CVE-2026-109619
AI description
CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.
- Description
- -
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
30
PHP: Upcoming Critical Security Release PHP’s security team has announced an upcoming release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. Public reporting identifies the issues as CVE-2026-109618 and CVE-2026-109619. Technical details and https://t.c
@secpoint
20 Oct 2026
142 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
About CVE-2026-109618 and CVE-2026-109619, the PHP RCE. The vulnerability is in the PHP's session upload progress path. It was introduced in PHP 5.4, enabled by default and process multipart data before application code. Read below for more info.
@rina4_tot
20 Oct 2026
25058 Impressions
13 Retweets
234 Likes
133 Bookmarks
5 Replies
1 Quote
Two critical PHP RCEs leaked before the embargo. watchTowr and Previdian both reproduced them. Patches are live now. CVE-2026-109618 and CVE-2026-109619. CVSS 9.2 officially. If you run PHP in production, you might want to start looking at this
@r007User
20 Oct 2026
182 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
PHP Remote Code Execution (CVE-2026-109618 & CVE-2026-109619) Information about two new remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS v3.1 10 / 10), has leaked ahead of their coordinated disclosure, and security firm
@bcs_erictaylor
20 Oct 2026
10830 Impressions
18 Retweets
118 Likes
72 Bookmarks
1 Reply
2 Quotes
PHPにおけるRCEの脆弱性（CVE-2026-109618 / CVE-2026-109619） https://t.co/CMW64AcyeY
@nxf_owl
20 Oct 2026
216 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
1 Quote
I'm only monitoring the situation! #php #CVE-2026-109618 #CVE-2026-109619 Will post updates if I can, but I might be too busy to do so. https://t.co/uqtWWi2oE5
@CisoDiagonal
20 Oct 2026
272 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
Two critical PHP zero-days are about to drop. CVE-2026-109618 & CVE-2026-109619 are reportedly RCE vulnerabilities, with PHP officially rating both CVSS 9.2. No technical details or workaround yet. Security updates are expected today. If you run PHP in production — be re
@UpwindMDR
20 Oct 2026
626 Impressions
0 Retweets
2 Likes
2 Bookmarks
0 Replies
0 Quotes
PHP(※１)において深刻度の高いRCE(※２)ゼロデイ脆弱性が見つかったとの話。 https://t.co/xsxOkIVtA4 CVE予約番号は CVE-2026-109618 CVE-2026-109619 (PHP 5以降の全バージョンが影響受けるがパッチは最新版8のみ提供との噂)
@ken_sugar
20 Oct 2026
500 Impressions
1 Retweet
0 Likes
0 Bookmarks
1 Reply
3 Quotes
A w środy nie chodziliśmy na kremówki, bo łataliśmy PHP. CVE-2026-109618 i CVE-2026-109619. Rzekomo RCE w podstawowym kodzie. https://t.co/y1CAtI7yAk
@Zaufana3Strona
20 Oct 2026
376 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
A w czwartki nie chodziliśmy na kremówki, bo łataliśmy PHP. CVE-2026-109618 i CVE-2026-109619. Rzekomo RCE w podstawowym kodzie. https://t.co/3vXapnvovg
@Zaufana3Strona
20 Oct 2026
232 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Embargoed PHP zero-days just leaked. watchTowr confirms 2 remote code execution flaws in PHP are real: CVE-2026-109618 and CVE-2026-109619. Fixes were meant to go public Thursday, 11am ET (5pm Paris). PHP runs ~7 in 10 websites, WordPress included. Is yours ready? https://t.co/
@Hecadium
20 Oct 2026
2 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes