Outbreak Alert: Critical PHP Remote Code Execution Vulnerabilities

CVE ID

CVE-2026-109619

CVE Title

Remote Code Execution in PHP via stale global state

NVD Severity

Not Assigned

FortiRecon Severity

CRITICAL

FortiRecon Score

90/100

Epss Score

0.05757

Exploited

Yes

Exploited by Ransomware Group(s)

No

Exploited by APT Group(s)

No

Included in CISA KEV List

No

Available working exploit(s)

0

Available POC exploit(s)

376

Darknet Mention(s)

4 (exploit, rstforums)

Telegram Mention(s)

18 (PwnForums - Chat, Team1914_official, 🔪 That Dark Web Guy - Part 3 🔪, FSEC INTEL ES 2.0 📡 🏴‍☠️, Hack Institute Chat, SHINY CORP, LΣҒΔ𝕽ΩLL 🇮🇱, Cyber32 Team | سایبر۳۲, Tunisian Maskers Cyber Force, PwnForums)

FortiRecon Intelligence Reporting(s)

2 (Darknet), 7 (OSINT), 1 (FortiGuard Research)

Vendor Advisory:

• http://www.openwall.com/lists/oss-security/2026/10/22/2

• https://www.wiz.io/blog/php2shell-php-rce

• http://www.openwall.com/lists/oss-security/2026/10/21/7

• http://www.openwall.com/lists/oss-security/2026/10/21/16

• http://www.openwall.com/lists/oss-security/2026/10/21/23

• http://www.openwall.com/lists/oss-security/2026/10/21/17

• https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

CVE ID

CVE-2026-109618

CVE Title

Remote Code Execution in PHP via out-of-memory corruption

NVD Severity

Not Assigned

FortiRecon Severity

CRITICAL

FortiRecon Score

90/100

Epss Score

0.05307

Exploited

Yes

Exploited by Ransomware Group(s)

No

Exploited by APT Group(s)

No

Included in CISA KEV List

No

Available working exploit(s)

0

Available POC exploit(s)

401

Darknet Mention(s)

4 (exploit, rstforums)

Telegram Mention(s)

18 (PwnForums - Chat, Team1914_official, FSEC INTEL ES 2.0 📡 🏴‍☠️, 🔪 That Dark Web Guy - Part 3 🔪, Hack Institute Chat, SHINY CORP, LΣҒΔ𝕽ΩLL 🇮🇱, Cyber32 Team | سایبر۳۲, Tunisian Maskers Cyber Force, PwnForums)

FortiRecon Intelligence Reporting(s)

7 (OSINT), 2 (Darknet), 1 (FortiGuard Research)

Vendor Advisory:

• https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

• https://www.wiz.io/blog/php2shell-php-rce

• http://www.openwall.com/lists/oss-security/2026/10/21/6