CVE-2026-109618
AssessTools
A tracked vulnerability identifier for one php2shell PHP flaw.
Why it's here
Placed in Assess: 2 article(s) of evidence from 3 source(s), led by security coverage, with 2 in the last 30 days. Confidence 44%.
Evidence (2)
- 10Simon Willison·10/21/2026securityPHP ships urgent security fixes for two critical RCE flaws
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were released to fix two critical vulnerabilities that could let an unauthenticated attacker execute code on affected servers under certain conditions. The PHP Foundation said the issues exposed structural weaknesses in its security process and outlined recent changes to strengthen auditing, decision-making, and staffing for security work.
- 8Hacker News·10/21/2026securityCloudflare rolls out protections for php2shell PHP flaws
Cloudflare says it deployed WAF mitigations for the php2shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, before public disclosure and enabled them by default for customers using its WAF. The flaws affect PHP 5.4 and later and can lead to denial of service, remote code execution, or data exposure, so Cloudflare is also monitoring for payload variations while urging customers to patch PHP.