Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-109618, CVE-2026-109619, Summary: This Security Alert addresses CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as PHP2Shell, allow for unauthenticated remote code execution in PHP. Oracle strongly recommends that customers apply the available security patches without delay. The Security Alert advisory will continue to be updated as additional product patches become…
KEV ✓
EPSS 1.00
CVSS 9.8
CVE-2026-109618
CVE-2026-109619
Oracle
Festo
Apache
PHP
WAGO
Belden
QNAP
Synology
ESET
Welotec
Juniper Networks
HPE
METTLER TOLEDO
Citrix
Cloud Software Group
Palo Alto Networks
Tenable
Splunk
Cisco
WordPress
Drupal
Joomla
výroba a průmysl
školství
FI
DE
FR
IT
BE
US
SK
CZ
CA
RU
NL
AT
SE
HR
GB
tg: zneužíváno
tg: zranitelnost
tg: rozbor
tg: novinka v produktu
tg: návod
tg: propagace
tp: malware
tp: phishing
tp: dodavatelský řetězec
tp: AI
tp: průmyslové systémy
3. 11. 2026 · zachyceno 04:30 · NCSC-FI · Oracle Security Alert Advisory CVE-2026-109618 and CVE-2026-109619
2. 11. 2026 12:00 · CERT@VDE · Two critical PHP vulnerabilities in several Festo Didactic products
2. 11. 2026 · zachyceno 16:00 · CERT-FR – avis · Multiples vulnérabilités dans macmon et NRSW (02 novembre 2026)
30. 10. 2026 12:32 · CSIRT Itálie (ACN) · ESET: aggiornamenti e mitigazioni per le vulnerabilità "PHP2Shell"
26. 10. 2026 23:15 · Aikido Security · How to patch PHP2Shell with free Aikido Images
26. 10. 2026 20:48 · Tenable Research · Discover and remediate PHP2Shell exposure with Tenable
26. 10. 2026 14:25 · ESET WeLiveSecurity · PHP2Shell: What to know about two critical PHP flaws
26. 10. 2026 10:19 · BleepingComputer · PHP2Shell security flaws now sucessfully exploited in the wild
26. 10. 2026 05:31 · Qualys · Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own
22. 10. 2026 10:00 · CSIRT.CZ – novinky · Kritické zranitelnosti PHP umožňují vzdálené spuštění kódu
22. 10. 2026 · zachyceno 21:30 · Splunk Advisories · SVD-2026-1013: Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026
21. 10. 2026 21:12 · Cisco PSIRT · Vulnerabilities in PHP Affecting Cisco Products: October 2026
21. 10. 2026 19:30 · Cyber Centre Kanada · AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619
21. 10. 2026 18:14 · Malwarebytes Labs · PHP2Shell: Why websites are going offline for emergency security updates
21. 10. 2026 18:00 · Palo Alto PSIRT · CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)
21. 10. 2026 17:18 · Securelist (Kaspersky) · Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
21. 10. 2026 17:10 · Cisco Talos · Two critical RCEs in PHP core
21. 10. 2026 17:03 · NÚKIB · Upozornění na "php2shell", dvě kritické zranitelnosti v PHP
21. 10. 2026 16:01 · NCSC-NL · NCSC-2026-0443 [1.00] [H/H] Kwetsbaarheden verholpen in PHP
21. 10. 2026 15:49 · CERT.at · Kritische Sicherheitslücken in PHP - Updates verfügbar
21. 10. 2026 15:40 · Palo Alto Unit 42 · Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
21. 10. 2026 14:44 · SANS Internet Storm Ctr. · Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
21. 10. 2026 · zachyceno 18:00 · CISA Advisories · Critical Vulnerabilities in PHP Require Immediate Patching
21. 10. 2026 14:00 · CERT-SE · Kritiska sårbarheter i PHP
21. 10. 2026 12:00 · CERT.hr · UPOZORENJE: Kritične ranjivosti u PHP-u – čeka se nadogradnja
21. 10. 2026 10:09 · SK-CERT (NBÚ SR) · Národné centrum kybernetickej bezpečnosti SK-CERT varuje pred dvoma kritickými zraniteľnosťami v PHP, identifikovanými a
21. 10. 2026 · zachyceno 21:30 · Fortinet PSIRT · PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
21. 10. 2026 06:00 · Huntress · Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
21. 10. 2026 · zachyceno 17:30 · Elastic Security · php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
21. 10. 2026 · zachyceno 15:01 · Sophos Threat Research · Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Risolta una vulnerabilità di sicurezza con gravità "alta" nei prodotti ESET Endpoint Encryption e Full Disk Encryption. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato, autenticato con privilegi limitati, di eseguire operazioni con privilegi elevati, accedere a informazioni sensibili, indurre i sistemi target ad autenticarsi verso sistemi remoti controllati dall'attaccante e, in alcuni casi, causare il la perdita d'accesso ai volumi cifrati.
EPSS 0.00
CVE-2026-75882
ESET
IT
FR
tg: zranitelnost
30. 10. 2026 12:43 · CSIRT Itálie (ACN) · Risolta vulnerabilità in prodotti ESET
29. 10. 2026 · zachyceno 17:00 · CERT-FR – avis · Vulnérabilité dans les produits ESET (29 octobre 2026)
Risolta vulnerabilità di sicurezza con gravità "alta", in diversi prodotti ESET. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di elevare i propri privilegi sui sistemi interessati.
CVE-2025-12858
ESET
IT
tg: zranitelnost
10. 9. 2026 12:44 · CSIRT Itálie (ACN) · Risolta vulnerabilità in prodotti ESET