Leaked critical PHP RCE flaws ahead of scheduled fixes

Home Explore Pricing Blog Docs New Tracker

Get the App

Cyber Threat Pulse

Huntress reports leaked PHP-core vulnerabilities CVE-2026-109618 and CVE-2026-109619 ahead of the October 21 release. Affected versions and exploit conditions remain unknown, with no confirmed exploitation or public PoC; inventory PHP deployments, prepare to patch, and monitor vendor updates and web-server behavior.

Sources (4)

Updated Oct 22, 2026

Leaked critical PHP RCE flaws ahead of scheduled fixes - Cyber Threat Pulse | NBot | nbot.ai

Cyber Threat Pulse

Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

PHP releases emergency fixes for 2 critical vulnerabilities

Critical PHP Vulnerabilities Put Most of the Web at Risk

PHP Security Vulnerabilities October 21, 2026