/
initial_access_vector:exploit_public_facing × cves:CVE-2026-109618 × criticity:critical × limpar

Resultados

3 casos · pág. 1/1

theregister.com · · 27 fontes · 38 atualizações critical

PHP2Shell: PHP patches critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619; broad exploitation attempts, ASLR-bypass exploit reported, UK government services offline, wide vendor and government response

The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…

CVE-2026-109618 CVE-2026-109619 government transportation
blog.checkpoint.com · critical

PHP2Shell: CVE-2026-109618 and CVE-2026-109619 PHP RCE flaws actively exploited, hitting 10% of organizations worldwide

Check Point Research reports active exploitation of two critical PHP engine vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Details leaked ahead of planned disclosure, and screenshots of a PHP2Shell attack tool are circulating. Since the leak, 10% of organizations worldwide have been "impacted", meanin…

CVE-2026-109618 CVE-2026-109619 telecommunications education
gbhackers.com · critical

Gcore offers free WAAP Enterprise to public agencies after php2shell PHP RCE flaws (CVE-2026-109618/109619) take European sites offline

Gcore is offering its WAAP Enterprise plan free to government bodies and public agencies until December 31, 2026. The offer follows the php2shell vulnerabilities, which forced public websites offline across Europe this week. Government portals in the Netherlands, Finland, Denmark and France, along with hospitals, schools and commercial si…

CVE-2026-109618 CVE-2026-109619 government healthcare