{"basis":"claimed","id":"CVE-2026-109618","name":"PHP Memory Corruption Vulnerability","vendorProject":"PHP Group","product":"PHP","publishedAt":"2026-10-21","cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"exploited":{"kevAdded":"2026-10-26","dueDate":"2026-10-29","ransomware":false},"epss":{"score":0.99999,"percentile":0.99998,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2026-10-22","daysToRule":null},"aws":{"status":"rule","firstOn":"2026-10-21","daysToRule":0},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"rule","firstOn":"2026-10-21","daysToRule":0},"f5":{"status":"rule","firstOn":"2026-10-21","daysToRule":0},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"RCE via OOM corruption","description":"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).","cwes":["CWE-416","CWE-755","CWE-824","CWE-1325","CWE-1419"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2026-10-22","firstIsNew":false,"daysToRule":null,"daysAtMost":1,"freePlan":true,"claims":[{"id":"e24c796df39fa45112e1880802bca0546c6a132bbc4cb8142fda06ed2a462286","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"c1d409ad838f47f59446f21cc438d5dd","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619). Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"51cc3ed4fd11befc236c6ba747e5e1672ca8b8f79bab9312822b3cbb6019bc39","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"f9a45927414245e3a64bb12d0a0c2f64","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"56d85e90ce1b06e9cfbd339814bd99bca70a56433bcb619f7c66f015891e2e9a","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"771c654ae1154d4daa72f4e1545d163c","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"a3239e8093fe2be42c63393d2ca58aa92a491746191a6af0cb824b92c10c80fa","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"217005865f0145f392300bac212afcc9","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"df398c35e20f316950107a72906b7b17877977ff0744c41c41780cfa1def5303","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"38efdb17ea594501bb55a1d71867b12e","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"2819941136260152b93717d4607f2d4e8f8456dfbf294d12243e8cc04ddb8b1e","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"4148ae686fdb4d01be673fab9d9c073d","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"320201c07c91435fd78531fcc0cd6f385b710b24ae61ca74a3f1b1a78dea5efd","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"1389aa259617437392ce149c48143645","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"1a51e6d019e718e0f96fa3e6b89f73057907ac582fd756c136b935156fa1de6a","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"4e315666e8e344cdb64119a3b5ccf32f","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619). Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"950b9cb06d2de0a076936314acc7f02033e3745a3ce9b101ae4f14366e448265","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"00c10e6cc4da4bd08722adeebcd95984","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"3bd19df220b50aafa5290a85fc28285d559f752c90cc92bca49b1fc34ffa7938","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"48ddf592361e4fdb97a8a85982dab691","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"e16623c837e9f24aaebf740b89875d5d7a87c744af6fa148ef3801d6e2e63d3c","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"3556683d512a47f2937899c524b1a4c6","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"333444cee56ff5702e4a5027d6a4fdcf8b12a093e9c16cff609169c0b611ea74","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"da07c85852e34625bb478496302ede46","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"7ca6a9c2170ff39701f3f6f7dc3f7598775f20e81ee1bd31e12050003d3e9ceb","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"19373a83abb840e18ab3ce5a7975ce1b","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:15.176Z"},{"id":"b948933282eb56d15dbd75690eb4e2183ef572239d74da69cc619d62452ca18d","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"07f0b6ddaabf40b1b2042dade8d613fa","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:15.176Z"},{"id":"7b0dad6af1012c0702fc9a1894845d8c4c0d24c98286907ce53b0dc62366adce","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"4148ae686fdb4d01be673fab9d9c073d","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6","change":"updated","default_action":"Block","published_on":"2026-10-28","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-28-waf-release/","source_title":"WAF Release - 2026-10-28","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6. Previous action: Block. New action: Block. Rule detection updated.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"d6c8484405ded7d0f06a20714fde1852af0d6d8dfab85ff05be498f9716c52e8","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"19373a83abb840e18ab3ce5a7975ce1b","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6","change":"updated","default_action":"Block","published_on":"2026-10-28","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-28-waf-release/","source_title":"WAF Release - 2026-10-28","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6. Previous action: Block. New action: Block. Rule detection updated.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"db1e292e8f4114d49634d23e4a6258c51771888b3b2f73d03b4ac27b9d93a6d2","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"771c654ae1154d4daa72f4e1545d163c","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3","change":"updated","default_action":"Block","published_on":"2026-10-30","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/","source_title":"WAF Release - 2026-10-30","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: Block. Rule detection updated.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"c3c0b736e3eb503ca2e0af8bdaee5af4776a13fbcad44a4c345f08d40f4759f4","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"48ddf592361e4fdb97a8a85982dab691","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3","change":"updated","default_action":"Block","published_on":"2026-10-30","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/","source_title":"WAF Release - 2026-10-30","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: Block. Rule detection updated.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"edd7883f6e8cac2892f4df716552e8d0ae668366002ae793e8586b8dc1b36bcb","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"217005865f0145f392300bac212afcc9","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4","change":"updated","default_action":"Block","published_on":"2026-10-30","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/","source_title":"WAF Release - 2026-10-30","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: Block. Rule detection updated.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"7f9b8e1e9cfbd25778d134ea4ae27c8b4a10409e090852fa88bb7cc47aef767e","cve_id":"CVE-2026-109618","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"3556683d512a47f2937899c524b1a4c6","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4","change":"updated","default_action":"Block","published_on":"2026-10-30","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/","source_title":"WAF Release - 2026-10-30","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: Block. Rule detection updated.","first_seen_at":"2026-11-02T21:00:14.891Z"}]},{"vendor":"aws","status":"rule","basis":"claimed","firstOn":"2026-10-21","firstIsNew":true,"daysToRule":0,"daysAtMost":null,"freePlan":false,"claims":[{"id":"655f6f0cb592c8784d4d469fb84f2916af6b4dee1c2ca1c9f5eb5a2805a6f3da","cve_id":"CVE-2026-109618","vendor":"aws","product":"PHP application managed rule group","rule_id":null,"rule_name":"PHP2Shell_BODY","change":"new","default_action":null,"published_on":"2026-10-21","source_url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","source_title":"AWS Managed Rules changelog","excerpt":"PHP application managed rule group This release updates the following rules: PHP2Shell_BODY: Released static version 2.3 of this rule group. The new PHP2Shell_BODY rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619 . For CVE-2026-109618 , the SizeRestrictions_BODY rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking…","first_seen_at":"2026-11-02T21:00:18.042Z"},{"id":"a6e54a1d7c79f75a084432c874d7085d0e67f30c5ade4cfe555e56222a7db5bb","cve_id":"CVE-2026-109618","vendor":"aws","product":"PHP application managed rule group","rule_id":null,"rule_name":"PHP2Shell_BODY_Extended","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","source_title":"AWS Managed Rules changelog","excerpt":"PHP application managed rule group This release updates the following rules: PHP2Shell_BODY_Extended: Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619 .","first_seen_at":"2026-11-02T21:00:18.042Z"},{"id":"db4d09f541cf8e575cec0d5e4379bac590f9bb78b35618d25a82ad816a497492","cve_id":"CVE-2026-109618","vendor":"aws","product":"PHP application managed rule group","rule_id":null,"rule_name":"PHP2Shell_BODY_Extended","change":"new","default_action":null,"published_on":"2026-10-22","source_url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","source_title":"AWS Managed Rules changelog","excerpt":"PHP application managed rule group This release updates the following rules: PHP2Shell_BODY_Extended: Released static version 2.4 of this rule group. The new PHP2Shell_BODY_Extended rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109618 . For more information, see NIST: National Vulnerability Database: CVE-2026-109618 . This rule group now detects CVE-2026-109618 directly. This supersedes the guidance in the version 2.3 entry, which d…","first_seen_at":"2026-11-02T21:00:18.042Z"}]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"rule","basis":"claimed","firstOn":"2026-10-21","firstIsNew":true,"daysToRule":0,"daysAtMost":null,"freePlan":false,"claims":[{"id":"ee64286ad934790e7b239c86d138bd5a69eef4935d5e839f49bbc6e5c149f44d","cve_id":"CVE-2026-109618","vendor":"fastly","product":"Next-Gen WAF","rule_id":null,"rule_name":"Added virtual patch for CVE-2026-109618 and CVE-2026-109619","change":"new","default_action":null,"published_on":"2026-10-21","source_url":"https://www.fastly.com/documentation/reference/changes/2026/10/added-virtual-patch-for-CVE-2026-109618-and-CVE-2026-109619/","source_title":"Added virtual patch for CVE-2026-109618 and CVE-2026-109619","excerpt":"Added virtual patch for CVE-2026-109618 and CVE-2026-109619. Fastly has created a virtual patch for CVE-2026-109618 and CVE-2026-109619 (php2shell) that is now available within your account. On 10/21/2026, two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (php2shell), were announced. They may allow unauthenticated attackers to achieve remote code execution (RCE) or cause a denial of service (DoS). You may be affected if you run a PHP version earlier than 8.5.12, 8.4.27, 8.3.…","first_seen_at":"2026-11-02T21:00:19.903Z"}]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2026-10-21","firstIsNew":true,"daysToRule":0,"daysAtMost":null,"freePlan":false,"claims":[{"id":"aa9fbdc01bd462158a4eec777f1e7d87b8d383853d607ef5aca524aa14a21762","cve_id":"CVE-2026-109618","vendor":"f5","product":"Attack signatures","rule_id":"200103697","rule_name":"PHP Remote Code Execution (2)","change":"new","default_action":null,"published_on":"2026-10-21","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200103697 \"PHP Remote Code Execution (2)\" (Command Execution, risk High), systems: PHP. References: CVE-2026-109618.","first_seen_at":"2026-11-02T21:00:23.824Z"},{"id":"51d1e19e65692592f5daecca499815571895a767c8b5fc65c4de1f637a17fd41","cve_id":"CVE-2026-109618","vendor":"f5","product":"Attack signatures","rule_id":"200204115","rule_name":"PHP Remote Code Execution (3)","change":"new","default_action":null,"published_on":"2026-10-21","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200204115 \"PHP Remote Code Execution (3)\" (Server Side Code Injection, risk High), systems: PHP. References: CVE-2026-109618.","first_seen_at":"2026-11-02T21:00:23.824Z"},{"id":"421f1e852bc9f61c4ec7ca0e7af2d72175d63f798d226b7be875b3646f9f372b","cve_id":"CVE-2026-109618","vendor":"f5","product":"Attack signatures","rule_id":"200103697","rule_name":"PHP Remote Code Execution (2)","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Updated: signature 200103697 \"PHP Remote Code Execution (2)\" (Server Side Code Injection, risk High), systems: PHP. References: CVE-2026-109618.","first_seen_at":"2026-11-02T21:00:23.656Z"},{"id":"fc2ae854d6aae6805690fdb1e91174f427178571fbf007d15598b84bd1408e7c","cve_id":"CVE-2026-109618","vendor":"f5","product":"Attack signatures","rule_id":"200204115","rule_name":"PHP Remote Code Execution (3)","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Updated: signature 200204115 \"PHP Remote Code Execution (3)\" (Server Side Code Injection, risk High), systems: PHP. References: CVE-2026-109618.","first_seen_at":"2026-11-02T21:00:23.656Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T22:17:38.477Z","cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T21:42:40.000Z","verdict":"partial","templateId":"CVE-2026-109618","templatePath":"http/cves/2026/CVE-2026-109618.yaml","requests":3,"blockedRequests":1,"rules":["200002","920470"],"note":"","requestDetail":[{"method":"POST","path":"/","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/","status":400,"blocked":true,"rules":["200002","920470"]},{"method":"GET","path":"/","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T21:42:40.000Z","verdict":"partial","templateId":"CVE-2026-109618","templatePath":"http/cves/2026/CVE-2026-109618.yaml","requests":3,"blockedRequests":1,"rules":["200002","920470"],"note":"","requestDetail":[{"method":"POST","path":"/","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/","status":400,"blocked":true,"rules":["200002","920470"]},{"method":"GET","path":"/","status":200,"blocked":false,"rules":[]}]}],"social":{"total":10,"first_seen":"2026-11-01T16:22:24.000Z","daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":1},{"day":"2026-11-02","posts":9}],"top_posts":[{"source":"x","kind":"post","url":"https://x.com/grok/status/2117381135231586310","author":"grok","author_name":"Grok","avatar_url":"https://pbs.twimg.com/profile_images/2057885623374290944/lmj0pawP_bigger.jpg","text":"@CWettreck @SmolfSmolf7 Nein, stimmt so nicht.\n\nMitte Oktober 2026 wurden kritische PHP-Schwachstellen (CVE-2026-109618/19, „PHP2Shell“) per KI entdeckt. Viele Regierungen (UK 32 Dienste, DE, FR, NL, BE, DK, CA, AU, Nepal 1000+, JP u.a.) schalteten Seiten vorsorglich ab, um zu p…","engagement":1,"posted_at":"2026-11-02T22:19:36.000Z"},{"source":"x","kind":"post","url":"https://x.com/PHPSiteAudit/status/2117388469576093855","author":"PHPSiteAudit","author_name":"PHP Site Audit","avatar_url":"https://pbs.twimg.com/profile_images/2113798338835329026/8xV9IpLp_bigger.png","text":"@TweetThreatNews The key point now is that a PHP patch is available — this PHP vulnerability should not be left unpatched while exploitation attempts are already being reported.\n\nPHP2Shell is CVE-2026-109618 + CVE-2026-109619, an unauthenticated RCE with a PHP CVSS v4.0 score of…","engagement":0,"posted_at":"2026-11-02T22:48:44.000Z"},{"source":"x","kind":"post","url":"https://x.com/TweetThreatNews/status/2117382289730490581","author":"TweetThreatNews","author_name":"Cybersecurity News Everyday","avatar_url":"https://pbs.twimg.com/profile_images/2113863388669575168/-spPI7aU_bigger.jpg","text":"Reversing Labs says AI-assisted research chained dormant PHP flaws CVE-2026-109618 and CVE-2026-109619 into PHP2Shell. It reports that pre-disclosure leaks triggered panic and early exploitation attempts before a patch was released.\nhttps://t.co/vu5XgKQlat","engagement":0,"posted_at":"2026-11-02T22:24:11.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/hendryadrian.bsky.social/post/3mzeehi2jlg2y","author":"hendryadrian.bsky.social","author_name":"Cybersecurity News Everyday","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:u6celkmubfsmbus5m3aqcrla/bafkreia4qa35zkjv4xhncsa5phk67qxkkinellckmbdgyczdad7yeqdy7m","text":"Reversing Labs says AI-assisted research chained dormant PHP flaws CVE-2026-109618 and CVE-2026-109619 into PHP2Shell. It reports that pre-disclosure leaks triggered panic and early exploitation attempts before a patch was released.","engagement":0,"posted_at":"2026-11-02T22:24:10.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/arc-codex.com/post/3mzebxsutmp26","author":"arc-codex.com","author_name":"Ross Nesbitt","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:i2y34utl5i7yo34ymxxksmwo/bafkreig5ypmdguz76wk3l6nghutld5u5qsfuhhmty4ldzgldgemoukocz4","text":"Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE\n\nThis article frames the risk very broadly by focusing on public-facing management interfaces, yet it also includes a highly technical threat hunt query that seems designed to filter out legitimate a…\n\nvia Unit…","engagement":0,"posted_at":"2026-11-02T21:39:37.000Z"},{"source":"x","kind":"post","url":"https://x.com/Jryck791/status/2117369220157858132","author":"Jryck791","author_name":"YogiBear_XRP","avatar_url":"https://pbs.twimg.com/profile_images/2100258519869956096/kUOGUYo0_bigger.jpg","text":"Why I’m holding the launch of the application: Since PHP2Shell (CVE-2026-109618 / CVE-2026-109619) was disclosed and patched around October 20–21, the active threat environment has been elevated. Confirmed real-world PHP2Shell activity so far has been limited (no widespread mass","engagement":0,"posted_at":"2026-11-02T21:32:15.000Z"},{"source":"x","kind":"post","url":"https://x.com/gedxagency/status/2117360364169941060","author":"gedxagency","author_name":"GEDX Agency","avatar_url":"https://pbs.twimg.com/profile_images/2116595861543112705/LywOoUpw_bigger.jpg","text":"1/ 🚨 PHP2Shell: si tu web corre en PHP 8.2–8.5, parcha hoy.\nCVE-2026-109618 y CVE-2026-109619 → RCE sin autenticación, CVSS 9.2. CISA ya las tiene en KEV (explotación activa). https://t.co/DKzWdxcFFJ","engagement":0,"posted_at":"2026-11-02T20:57:04.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/alt.pds.lefht.cc/post/3mzdzwfjp3225","author":"alt.pds.lefht.cc","author_name":"alt","avatar_url":null,"text":"3. CVE-2026-109618 · 9 people 🔥\n🟥 Critical 9.2 · PHP\n\nRCE via OOM corruption","engagement":0,"posted_at":"2026-11-02T19:15:40.076Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/alt.pds.lefht.cc/post/3mzdzwf5fjc25","author":"alt.pds.lefht.cc","author_name":"alt","avatar_url":null,"text":"🛡️ Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-98432 · 33 people\n2. CVE-2026-97229 · 10 people 🔥\n3. CVE-2026-109618 · 9 people 🔥\n4. CVE-2026-111357 · 9 people 🔥\n5. CVE-2026-118527 · 8 people 🔥\n\n🔥 = on CISA's Known Exploited list · details in the thread 🧵","engagement":0,"posted_at":"2026-11-02T19:15:39.698Z"}],"exploit_repositories":[{"source":"github","kind":"poc","url":"https://github.com/sahmsec/CVE-2026-109618-PHP2SHELL","author":"sahmsec","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/141112651?v=4","text":"sahmsec/CVE-2026-109618-PHP2SHELL: POC of CVE-2026-109618(PHP2SHELL)","engagement":0,"posted_at":"2026-11-01T16:22:24.000Z"}]}}