CVE-2026-109618

CVSS

—

EPSS

—

CISA KEV

Not listed

Exploitation

No report

Public exploits

None seen

State

Unknown

Coverage

• SecurityWeek◇Specialist. Specialist publisher: established trade press, or expert analysis with a track record2 hours ago

  PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

  Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution. The post PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws appeared first on SecurityWeek.

  ↗securityweek.com/php2shell-mass-exploitation-lo…(opens the publisher's site in a new tab)
• 

  Huntress◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards5 hours ago

  Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

  Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.

  ↗huntress.com/blog/php2shell-leaked-critical-php…(opens the publisher's site in a new tab)

What we observed