CVE-2026-109618

Headlines · 4

1. 4d
   Honeypot captures first reported PHP2Shell exploitation

   Perplexity researcher Adel Karimi said six honeypot sensors detected PHP2Shell exploitation between 19:26 and 19:31 UTC on October 24. In a honeypot running PHP 8.4.26 with Apache mod_php, attackers launched /bin/sh and executed 35 shell processes through a four-stage attack involving memory pressure, an oversized PHPSESSID cookie, and adjustment of the final request using obtained memory addresses. The PHP development team patched CVE-2026-109618 and CVE-2026-109619, while Wiz and Calif said AI assistance helped them find the unusually destructive vulnerabilities.

   iThome 台湾 · 🔥 0
2. Oct 23
   Consultant apologizes for early disclosure of critical PHP flaws

   Consultant petecooper apologized for posting about CVE-2026-109618 and CVE-2026-109619 before an embargo ended, saying they did not know an embargo existed and had wanted to warn followers about PHP's four-week release cycle. The report says multiple leaks circulated, the PHP Foundation moved its announcement forward by one day, and Chainguard also disclosed a fix more than six hours early. It describes both vulnerabilities as affecting the PHP runtime, having been discovered using AI tools, and carrying critical severity scores of 9.2. The precise sequence of the disclosures remains unclear, and the report does not establish that petecooper's post directly caused the PHP Foundation to change its announcement schedule.

   Tom’s Hardware · 🔥 0
3. Oct 23
   Frontier AI Models Used in Reported PHP RCE Exploit Development

   A report says security teams from Calif and Wiz used frontier AI models to find two PHP remote-code-execution vulnerabilities and build exploits. The flaws, CVE-2026-109618 and CVE-2026-109619, are marketed as PHP2Shell. The report says a 2024 PHP Foundation audit had identified CVE-2026-109618 but could not determine how to create an exploit from the theoretical issue or agree on a fix. It cites an estimate that PHP2Shell could affect as much as 70% of the internet, including thousands of major websites, though the report does not substantiate that estimate. There is also disagreement over whether working exploit attempts occurred before the patch was released.

   Hacker News 首页（100+ 分） · 🔥 0
4. Oct 22
   watchTowr FAQ confirms PHP2Shell PHP flaws exploited in the wild

   Security firm watchTowr's FAQ page states that CVE-2026-109618 and CVE-2026-109619 are collectively named PHP2Shell and that the flaws have already been exploited in the wild, according to a report by OSCHINA (开源中国). The report says watchTowr observed the exploitation through its globally distributed Attacker Eye honeypot network, and it describes this as the first source to confirm the bugs moved from theoretical risk to a real threat. The report cites no independent measurement, targeting details or exploitation volume, and the article also notes that the PHP vulnerability had drawn attention from Japan's prime minister.

   开源中国 · 🔥 0

Experience and discussion from the community

Share my CVE-2026-109618 experienceAsk about CVE-2026-109618