{"basis":"claimed","id":"CVE-2026-109619","name":"PHP Stale Internal Request-State Vulnerability","vendorProject":"PHP Group","product":"PHP","publishedAt":"2026-10-21","cvss":{"score":9.2,"severity":"CRITICAL","version":"4.0"},"exploited":{"kevAdded":"2026-10-26","dueDate":"2026-10-29","ransomware":false},"epss":{"score":0.99999,"percentile":0.99999,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2026-10-22","daysToRule":null},"aws":{"status":"rule","firstOn":"2026-10-21","daysToRule":0},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"rule","firstOn":"2026-10-21","daysToRule":0},"f5":{"status":"rule","firstOn":"2026-10-21","daysToRule":0},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"RCE via stale global state","description":"PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).","cwes":["CWE-416","CWE-755","CWE-824","CWE-1325","CWE-1419"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2026-10-22","firstIsNew":false,"daysToRule":null,"daysAtMost":1,"freePlan":true,"claims":[{"id":"a2b8abcadeb37163aa99ec383f0fe49dc54929837446f0378cbcf69be92bd5dd","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"c1d409ad838f47f59446f21cc438d5dd","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619). Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"4b83fd459e61f23deb86e62596c0fb9cd8b2287ed8da6b08d4b4611ea37924b1","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"f9a45927414245e3a64bb12d0a0c2f64","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"a170f021d0aafc78df314c8d6f6ca04b19649c757171e7b385c4f406cd56b439","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"771c654ae1154d4daa72f4e1545d163c","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"9e0d23453ab097a3930391599071d557d2ae86074295eb7411e18ed4bbb06a88","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"217005865f0145f392300bac212afcc9","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"c9773f50af0b40af8fe7de986ac459672d8ac8bc4721f87de8a1acab2171862b","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"38efdb17ea594501bb55a1d71867b12e","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"16f3da1b5946f80c33064de0e39f3a4d04c8d2f5827e6a6ebdaf4f4b2ca2d445","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"4148ae686fdb4d01be673fab9d9c073d","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"b0150e205812bbeae46d8960795f1c38dd89e065e4a5b64925c109342c5c479c","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"1389aa259617437392ce149c48143645","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"2da2412f4d03960ebd2fd87e64eed3936e20813cc2296dbb00ebe59b3d3acec2","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"4e315666e8e344cdb64119a3b5ccf32f","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619). Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"9ccd8848fa26d4626854ac085046f6105cdf7105f22ebfe4f42b826151c2bae0","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"00c10e6cc4da4bd08722adeebcd95984","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"84350047ec76bf3a89890f1a4555d9048b72f8c0b8ae4116ceb68db3aea6a0ca","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"48ddf592361e4fdb97a8a85982dab691","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"5a0552ce56e8fdd586c42870f67e1018245f2f2909995597ead0425e6f15e0ae","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"3556683d512a47f2937899c524b1a4c6","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"9c5d9929dd34387d13472c3761bdc4ed93925bd8019753c627188fa750002803","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"da07c85852e34625bb478496302ede46","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"47ffe2d78a1608daf173460e95ca18c599cae5bebe85c87c7fd8039cc432adef","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"19373a83abb840e18ab3ce5a7975ce1b","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:15.176Z"},{"id":"0c7a16b90866c12c5a2585a7f60d05fda7cfa893c64e251894c3310c181c7471","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"07f0b6ddaabf40b1b2042dade8d613fa","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","source_title":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.","first_seen_at":"2026-11-02T21:00:15.176Z"},{"id":"b03a94351d8095a98270bc0ce0fdf3c35c1104762efc7eaaf3f425fafc75fdbf","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"4148ae686fdb4d01be673fab9d9c073d","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6","change":"updated","default_action":"Block","published_on":"2026-10-28","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-28-waf-release/","source_title":"WAF Release - 2026-10-28","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6. Previous action: Block. New action: Block. Rule detection updated.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"a584e091f7d028d75997a8a672e652ff7321e3f649c25620eabc7aeaf0f27fce","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"19373a83abb840e18ab3ce5a7975ce1b","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6","change":"updated","default_action":"Block","published_on":"2026-10-28","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-28-waf-release/","source_title":"WAF Release - 2026-10-28","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6. Previous action: Block. New action: Block. Rule detection updated.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"c141d6264d20214495697bb7f5e5a3022da206b03eca95201671d3a89ce883ea","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"771c654ae1154d4daa72f4e1545d163c","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3","change":"updated","default_action":"Block","published_on":"2026-10-30","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/","source_title":"WAF Release - 2026-10-30","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: Block. Rule detection updated.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"0a77b7acab7e555ff4bfe098c189d22f4e167029b87e43d043ff25622a23a827","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"48ddf592361e4fdb97a8a85982dab691","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3","change":"updated","default_action":"Block","published_on":"2026-10-30","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/","source_title":"WAF Release - 2026-10-30","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: Block. Rule detection updated.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"99aedfbcbea284d3551583bfb51fed1e12f30e040b7cd99c310b98c45e1a8979","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"217005865f0145f392300bac212afcc9","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4","change":"updated","default_action":"Block","published_on":"2026-10-30","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/","source_title":"WAF Release - 2026-10-30","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: Block. Rule detection updated.","first_seen_at":"2026-11-02T21:00:14.891Z"},{"id":"37d4ee4fe2307bae074c938f649386c7f61b41e0b4a53ba9c1ff0b17cc260156","cve_id":"CVE-2026-109619","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"3556683d512a47f2937899c524b1a4c6","rule_name":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4","change":"updated","default_action":"Block","published_on":"2026-10-30","source_url":"https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/","source_title":"WAF Release - 2026-10-30","excerpt":"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: Block. Rule detection updated.","first_seen_at":"2026-11-02T21:00:14.891Z"}]},{"vendor":"aws","status":"rule","basis":"claimed","firstOn":"2026-10-21","firstIsNew":true,"daysToRule":0,"daysAtMost":null,"freePlan":false,"claims":[{"id":"39bce4ad46ee5758c1a1cb2824f32ce95babc1b5fc6757059bea5b0bd65d619e","cve_id":"CVE-2026-109619","vendor":"aws","product":"PHP application managed rule group","rule_id":null,"rule_name":"PHP2Shell_BODY","change":"new","default_action":null,"published_on":"2026-10-21","source_url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","source_title":"AWS Managed Rules changelog","excerpt":"PHP application managed rule group This release updates the following rules: PHP2Shell_BODY: Released static version 2.3 of this rule group. The new PHP2Shell_BODY rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619 . For CVE-2026-109618 , the SizeRestrictions_BODY rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking…","first_seen_at":"2026-11-02T21:00:18.042Z"},{"id":"4249906c4c1d02997a2b2451972c5182dff85f53f45dfdabf1adc6d8eeeb50b8","cve_id":"CVE-2026-109619","vendor":"aws","product":"PHP application managed rule group","rule_id":null,"rule_name":"PHP2Shell_BODY_Extended","change":"updated","default_action":null,"published_on":"2026-10-22","source_url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","source_title":"AWS Managed Rules changelog","excerpt":"PHP application managed rule group This release updates the following rules: PHP2Shell_BODY_Extended: Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619 .","first_seen_at":"2026-11-02T21:00:18.042Z"}]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"rule","basis":"claimed","firstOn":"2026-10-21","firstIsNew":true,"daysToRule":0,"daysAtMost":null,"freePlan":false,"claims":[{"id":"50368f9c4c93e5d2b099b2560e1dadcd3929d5492b6b08864b8a9bb35c42d944","cve_id":"CVE-2026-109619","vendor":"fastly","product":"Next-Gen WAF","rule_id":null,"rule_name":"Added virtual patch for CVE-2026-109618 and CVE-2026-109619","change":"new","default_action":null,"published_on":"2026-10-21","source_url":"https://www.fastly.com/documentation/reference/changes/2026/10/added-virtual-patch-for-CVE-2026-109618-and-CVE-2026-109619/","source_title":"Added virtual patch for CVE-2026-109618 and CVE-2026-109619","excerpt":"Added virtual patch for CVE-2026-109618 and CVE-2026-109619. Fastly has created a virtual patch for CVE-2026-109618 and CVE-2026-109619 (php2shell) that is now available within your account. On 10/21/2026, two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (php2shell), were announced. They may allow unauthenticated attackers to achieve remote code execution (RCE) or cause a denial of service (DoS). You may be affected if you run a PHP version earlier than 8.5.12, 8.4.27, 8.3.…","first_seen_at":"2026-11-02T21:00:19.903Z"}]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2026-10-21","firstIsNew":true,"daysToRule":0,"daysAtMost":null,"freePlan":false,"claims":[{"id":"8a546cc5e9f161b31855e3998361b9f895ca7af26a70a0bb9f685dcef4139ac4","cve_id":"CVE-2026-109619","vendor":"f5","product":"Attack signatures","rule_id":"200204113","rule_name":"PHP Remote Code Execution","change":"new","default_action":null,"published_on":"2026-10-21","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200204113 \"PHP Remote Code Execution\" (Server Side Code Injection, risk High), systems: PHP. References: CVE-2026-109619.","first_seen_at":"2026-11-02T21:00:23.824Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T22:17:38.477Z","cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total"},"measured":[],"social":{"total":6,"first_seen":"2026-11-02T16:12:42.000Z","daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":6}],"top_posts":[{"source":"x","kind":"post","url":"https://x.com/PHPSiteAudit/status/2117388469576093855","author":"PHPSiteAudit","author_name":"PHP Site Audit","avatar_url":"https://pbs.twimg.com/profile_images/2113798338835329026/8xV9IpLp_bigger.png","text":"@TweetThreatNews The key point now is that a PHP patch is available — this PHP vulnerability should not be left unpatched while exploitation attempts are already being reported.\n\nPHP2Shell is CVE-2026-109618 + CVE-2026-109619, an unauthenticated RCE with a PHP CVSS v4.0 score of…","engagement":0,"posted_at":"2026-11-02T22:48:44.000Z"},{"source":"x","kind":"post","url":"https://x.com/TweetThreatNews/status/2117382289730490581","author":"TweetThreatNews","author_name":"Cybersecurity News Everyday","avatar_url":"https://pbs.twimg.com/profile_images/2113863388669575168/-spPI7aU_bigger.jpg","text":"Reversing Labs says AI-assisted research chained dormant PHP flaws CVE-2026-109618 and CVE-2026-109619 into PHP2Shell. It reports that pre-disclosure leaks triggered panic and early exploitation attempts before a patch was released.\nhttps://t.co/vu5XgKQlat","engagement":0,"posted_at":"2026-11-02T22:24:11.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/hendryadrian.bsky.social/post/3mzeehi2jlg2y","author":"hendryadrian.bsky.social","author_name":"Cybersecurity News Everyday","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:u6celkmubfsmbus5m3aqcrla/bafkreia4qa35zkjv4xhncsa5phk67qxkkinellckmbdgyczdad7yeqdy7m","text":"Reversing Labs says AI-assisted research chained dormant PHP flaws CVE-2026-109618 and CVE-2026-109619 into PHP2Shell. It reports that pre-disclosure leaks triggered panic and early exploitation attempts before a patch was released.","engagement":0,"posted_at":"2026-11-02T22:24:10.000Z"},{"source":"x","kind":"post","url":"https://x.com/Jryck791/status/2117369220157858132","author":"Jryck791","author_name":"YogiBear_XRP","avatar_url":"https://pbs.twimg.com/profile_images/2100258519869956096/kUOGUYo0_bigger.jpg","text":"Why I’m holding the launch of the application: Since PHP2Shell (CVE-2026-109618 / CVE-2026-109619) was disclosed and patched around October 20–21, the active threat environment has been elevated. Confirmed real-world PHP2Shell activity so far has been limited (no widespread mass","engagement":0,"posted_at":"2026-11-02T21:32:15.000Z"},{"source":"x","kind":"post","url":"https://x.com/gedxagency/status/2117360364169941060","author":"gedxagency","author_name":"GEDX Agency","avatar_url":"https://pbs.twimg.com/profile_images/2116595861543112705/LywOoUpw_bigger.jpg","text":"1/ 🚨 PHP2Shell: si tu web corre en PHP 8.2–8.5, parcha hoy.\nCVE-2026-109618 y CVE-2026-109619 → RCE sin autenticación, CVSS 9.2. CISA ya las tiene en KEV (explotación activa). https://t.co/DKzWdxcFFJ","engagement":0,"posted_at":"2026-11-02T20:57:04.000Z"}],"exploit_repositories":[{"source":"github","kind":"poc","url":"https://github.com/K2uci/PHP2ShellPOC-CVE-2026-109619","author":"K2uci","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/148832097?v=4","text":"K2uci/PHP2ShellPOC-CVE-2026-109619","engagement":0,"posted_at":"2026-11-02T16:12:42.000Z"}]}}