Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

highVulnerabilityimportance 42CVE-2026-109619 CVE-2026-109618

AI summary

Posted by Emmanuel Fleury on Oct 22 Yes, CVE-2026-109618 and CVE-2026-109619 have been found together but seems to https://calif.io/php2shell/ Regards

Read the original

Tags#cve-2026-109619 #cve-2026-109618 #vulnerability

Vulnerabilities mentionedAll →

CVE-2026-1096199.26%
PHP has various global state that temporarily points into request memory
published 1d ago· php php PoC ×9+1 related

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-109619

Full article

Posted by Emmanuel Fleury on Oct 22 Yes, CVE-2026-109618 and CVE-2026-109619 have been found together but seems to https://calif.io/php2shell/ Regards

This source does not provide full text. Read it at seclists.org.

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Vulnerabilities mentionedAll →

Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched

Critical PHP Vulnerabilities Were Under Attack Days Before Security Updates Were Released

PHP Fixes Two Critical RCE Vulnerabilities Allowing Unauthenticated Code Execution

Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

PHP2Shell Exploitation Started Days Before Patches

PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.

What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers

Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

Tech and Security Companies Respond to PHP2Shell Vulnerabilities

Amazon says PHP2Shell exploitation began 4 days before patches

New Serious PHP Vulnerabilities Released and Patched

Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched

PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and 5.3.3 (EL6)new

PHP2Shell exploit bypasses protections designed to stop remote code executionnew

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global statenew

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state