[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYE2LVbdy8wmeuZraT9BEYZ_AgP2unK7iZrY-Nhax_K4":3,"g5a-risk:CVE-2026-109619":128},{"success":4,"data":5,"meta":125},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":22,"epssPercentile":13,"epssTimeSeries":23,"severity":28,"affectedProducts":29,"affectedProductsCount":30,"references":31,"referencesCount":72,"weaknesses":73,"weaknessesCount":30,"isActivelyExploited":4,"cisaInfo":74,"otxData":13,"relatedBlogPosts":76,"seoMetadata":77,"configurations":102,"relatedVendorCves":103,"notableEvents":104},"CVE-2026-109619","What is CVE-2026-109619?","Unauthenticated remote code execution vulnerability in PHP core, the second of two flaws known as \"php2shell\". This one had not been independently reproduced at the time of writing. The PHP security team rates it critical (CVSS v4.0 9.2) and scheduled an out-of-band security release for 21 October 2026 at 14:00 UTC, which publishes the affected and fixed versions; CERT-EU (Security Advisory 2026-018) warns that all PHP versions from PHP 5 onwards could be affected. Details leaked on 20 October 2026, about 15:20 UTC, ahead of a coordinated disclosure planned for later that week, and the PHP team brought its release forward. There are reports of exploitation in the wild, not yet confirmed by the PHP security team or listed by CISA. There are also reports of a leaked exploit tool called \"PHP2Shell\" said to work against every release from PHP 5.4.0, and researchers expect mass exploitation soon after the patch is published. The root cause has not been published by PHP. An unverified write-up circulating with a proof-of-concept bundle attributes the php2shell flaws to heap use-after-free bugs in the session extension's upload progress handler (session.upload_progress, php_session_rfc1867_callback) and in the multipart\u002Fform-data parser, so any multipart POST to a PHP endpoint may reach the vulnerable code.","Unauthenticated remote code execution vulnerability in PHP core, the second of two flaws known as \"php2shell\". This one had not been independently reproduced...","2026-10-20T00:00:00","2026-10-21T08:51:37.790331",9.2,null,{"CVSSMetricV31":13,"CVSSMetricV30":13,"CVSSMetricV2":13,"CVSSMetricV40":15},[16],{"Source":17,"Type":18,"CVSSData":19},"security@php.net","Primary",{"Version":20,"VectorString":13,"BaseScore":12,"BaseSeverity":21,"AttackVector":13,"AttackComplexity":13,"AttackRequirements":13,"PrivilegesRequired":13,"UserInteraction":13,"VulnConfidentialityImpact":13,"VulnIntegrityImpact":13,"VulnAvailabilityImpact":13,"SubConfidentialityImpact":13,"SubIntegrityImpact":13,"SubAvailabilityImpact":13,"ExploitMaturity":13,"ConfidentialityRequirement":13,"IntegrityRequirement":13,"AvailabilityRequirement":13,"ModifiedAttackVector":13,"ModifiedAttackComplexity":13,"ModifiedAttackRequirements":13,"ModifiedPrivilegesRequired":13,"ModifiedUserInteraction":13,"ModifiedVulnConfidentialityImpact":13,"ModifiedVulnIntegrityImpact":13,"ModifiedVulnAvailabilityImpact":13,"ModifiedSubConfidentialityImpact":13,"ModifiedSubIntegrityImpact":13,"ModifiedSubAvailabilityImpact":13,"Safety":13,"Automatable":13,"Recovery":13,"ValueDensity":13,"VulnerabilityResponseEffort":13,"ProviderUrgency":13},"4.0","CRITICAL",0.99999,[13,24,25,26,27,27,22],0.05757,0.05991,0.06217,0.99997,"Critical",[],0,[32,37,43,47,52,56,60,65,69],{"url":33,"source":34,"tags":35},"https:\u002F\u002Fwww.php.net\u002Farchive\u002F2026.php#2026-10-20-1","Php",[36],"Vendor Advisory",{"url":38,"source":39,"tags":40},"https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Fphp2shell-leaked-critical-php-vulnerabilities","Huntress",[41,42],"Third Party Advisory","Mitigation",{"url":44,"source":45,"tags":46},"https:\u002F\u002Fwatchtowr.com\u002Fintelligence\u002Fphp-cve-2026-109618-faq\u002F","Watchtowr",[41],{"url":48,"source":49,"tags":50},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fphp-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow\u002F","Bleepingcomputer",[51],"Press\u002FMedia Coverage",{"url":53,"source":54,"tags":55},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fphp2shell-two-unpatched-critical-php.html","Thehackernews",[51],{"url":57,"source":58,"tags":59},"https:\u002F\u002Fgithub.com\u002FNeo23x0\u002Fprocess-watcher\u002Fblob\u002Fmain\u002Femerging-threats\u002Fphp-rce-october-26\u002FREADME.md","GitHub",[42],{"url":61,"source":62,"tags":63},"https:\u002F\u002Fcert.europa.eu\u002Fpublications\u002Fsecurity-advisories\u002F2026-018\u002F","Europa",[41,64],"US Government Resource",{"url":66,"source":67,"tags":68},"https:\u002F\u002Fsansec.io\u002Fresearch\u002Fphp2shell","Sansec",[41],{"url":70,"source":34,"tags":71},"https:\u002F\u002Fwww.php.net\u002Fsupported-versions.php",[36],9,[],{"shortDescription":75,"requiredAction":75,"vulnerabilityName":75,"dateAdded":13},"",[],{"title":78,"metaDescription":79,"keywords":80,"canonicalUrl":81,"structuredData":82},"What is CVE-2026-109619? Vulnerability Analysis | Security Advisory | EdgeProtect","Comprehensive analysis of CVE-2026-109619, a critical severity cyber security vulnerability from 2026. High exploit probability (100.0%). Unauthenticated rem...","CVE-2026-109619, CVE-2026-109619 vulnerability, CVE-2026-109619 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation, high risk vulnerability, actively exploited, exploit available","\u002Fwhat-is\u002Fcve-2026-109619",{"@context":83,"@type":84,"headline":78,"description":79,"datePublished":10,"dateModified":11,"author":85,"publisher":89,"about":93,"mainEntityOfPage":97,"articleSection":100,"keywords":101},"https:\u002F\u002Fschema.org","TechArticle",{"@type":86,"name":87,"url":88},"Organization","EdgeProtect","https:\u002F\u002Fedgeprotect.io",{"@type":86,"name":87,"url":88,"logo":90},{"@type":91,"url":92},"ImageObject","https:\u002F\u002Fedgeprotect.io\u002Fimg\u002Flogos\u002Fedgeprotect-logo-512.png",{"@type":94,"name":6,"description":95,"additionalType":96},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":98,"@id":99},"WebPage","https:\u002F\u002Fedgeprotect.io\u002Fwhat-is\u002Fcve-2026-109619","Cybersecurity","CVE-2026-109619, CVE-2026-109619 vulnerability, CVE-2026-109619 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[],[],[105,112,119],{"id":106,"eventType":107,"eventTime":108,"details":109,"label":110,"color":111},"23909eb3-ce1e-493a-9fa9-3e2656a7c850","NEW_NVD","2026-10-21T08:16:56.250613+00:00","New CVE added to NVD","Published to NVD","blue",{"id":113,"eventType":114,"eventTime":115,"details":116,"label":117,"color":118},"6e1d887c-e655-4db2-8354-19c4db171c67","HIGH_EPSS_DELTA","2026-10-26T04:05:30.862236+00:00","Daily EPSS score increased by 0.938 on 2026-10-23","EPSS Score Increased","red",{"id":120,"eventType":121,"eventTime":122,"details":123,"label":124,"color":118},"e9991d74-e157-4243-b57e-bdef139bc9f8","NEW_CISA","2026-10-27T04:01:15.580071+00:00","CVE added to CISA Known Exploited Vulnerabilities","Added to CISA KEV",{"lastModified":11,"cacheTime":126,"version":127},1793209762967,"2.0",{"score":129,"band":28,"action":130,"scoredAt":131},89,"Emergency patch","2026-10-28T07:22:35.657043+00:00"]