Act
active
Critical PHP RCE Flaws (CVE-2026-109618/619) — PoC Live Before Patch
- Engineer — Act: PHP carries a CVSS 9.4 RCE pair with public PoC already circulating before today’s emergency patch drop — update all PHP installations to the patched release as soon as it publishes and restrict external access to PHP services in the interim.
- SOC/IR — Act: PoC availability ahead of the patch means exploitation attempts are likely imminent; hunt for anomalous web-shell activity and suspicious PHP process spawning across web-facing servers since today, and tune WAF/EDR rules for PHP exploitation patterns.
- Leader — Plan: CVSS 9.4 with pre-patch PoC in wide-use infrastructure warrants confirming PHP exposure across your environment this week and ensuring engineering teams treat today’s emergency patch as P1 — not yet board-level but could escalate if exploitation becomes widespread.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.