Act
active
Critical PHP RCE CVE-2026-109618 / CVE-2026-109619 with Public PoC
- Engineer — Act: Public PoCs exist on GitHub for both critical RCE flaws in PHP, which is widely deployed across web servers and CMS stacks; patch PHP to the latest patched release immediately and check whether PHP-FPM or CGI mode configurations are specifically exposed.
- SOC/IR — Act: With public PoCs live and multi-source corroboration, active exploitation of these PHP RCE flaws is likely imminent; hunt for anomalous web server child-process spawning and web shell artifacts in document roots since at least the PoC publication date.
- Leader — Plan: Critical PHP RCEs with public PoCs in a language powering a large share of web infrastructure warrant confirming organisational PHP exposure and verifying engineering has the patch cycle underway this week; not yet KEV-listed or at Log4Shell-scale, but monitor in case it escalates to a board-question event.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.