CVE-2026-109618 — PHP use after free

Coverage

1. AWS Weekly Roundup: Amazon Polly Generative engine, TorchNeuron for Trainium, and more (October 26, 2026)
   AWS News Blog 26 Oct 2026, 15:02 UTC Cloud & Infrastructure

   A few weeks ago I presented to a small group of commercial and technology leaders from Brazilian agribusiness at the AWS office in São Paulo. My talk ran through where generative AI fits across the different stages of an agribusiness…

2. Bitcoin reward offered to anyone who could break into an unpatched server running PHP, hacker cracks site and claims bounty
   Tom's Hardware 26 Oct 2026, 10:30 UTC Semiconductors

   A hacker has successfully breached a vulnerable server, claiming a prize pot worth $2,021.22 in Bitcoin after exploiting PHP2Shell vulnerabilities, a posting on the Steal My Bitcoin website has shown. The challenge's creator confirmed the…

3. PHP2Shell security flaws now sucessfully exploited in the wild
   BleepingComputer 26 Oct 2026, 09:19 UTC Cybersecurity

   Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]

4. PHP2Shell was only the beginning: AI is accelerating the patch race
   The New Stack 23 Oct 2026, 14:00 UTC Cloud & Infrastructure

   Government websites and public services across Europe went offline this week as organizations responded to two newly disclosed PHP vulnerabilities. Germany took several federal websites offline, France temporarily shut down prefecture…

5. Devastated forum user who accidentally broke the PHP news embargo comes clean
   Tom's Hardware 23 Oct 2026, 11:15 UTC Semiconductors

   A Hacker News user who shared news about the recent PHP vulnerabilities revealed by ChatGPT Sol before an embargo, which they claimed to be unaware of, has taken to the platform to apologize for the post. According to petecooper , they…

6. PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
   The Hacker News 23 Oct 2026, 07:40 UTC Cybersecurity

   Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be…

7. PHP loophole affected by Sonos Audio Official App Pauses Domestic Cloudy Music, QQQ Music, Cool Dog Music, Cool My Music Service
   IT Home (EN Mirror) 23 Oct 2026, 05:42 UTC Hardware Translated from zh-cn
8. Security Update on PHP2Shell: Impact for Docker Customers
   Docker Blog 22 Oct 2026, 17:22 UTC DevOps & SRE

   Summary On Tuesday, October 20, 2026, Docker began tracking two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 , commonly known as PHP2Shell. The vulnerabilities allow attackers to execute code remotely in PHP core…

9. The disastrous PHP vulnerabilities were exploited days before the patch
   The Verge Hardware 22 Oct 2026, 16:49 UTC Hardware

   Hackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to a report from Amazon Threat Intelligence . CJ Moses, Amazon chief information security officer, writes that the company's…

10. AI found a critical PHP flaw. The bigger failure began in 2024.
    The New Stack 22 Oct 2026, 15:01 UTC Cloud & Infrastructure

    Did one of your favorite websites go dark on Wednesday? Some did, as operators took services offline while they waited for fixes to two critical flaws in PHP , the language behind much of the web. The precaution didn’t mean those sites…

11. New Serious PHP Vulnerabilities Released and Patched
    Schneier on Security 22 Oct 2026, 13:26 UTC Cybersecurity

    PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to…

12. OpenAI says ChatGPT Sol helped uncover critical PHP flaws that could affect 70% of websites
    Tom's Hardware 22 Oct 2026, 10:30 UTC Semiconductors

    OpenAI announced in a press release on Oct. 21 that researchers working under its “Patch the Planet” cybersecurity initiative used its AI model GPT-5.6 Sol to uncover critical security vulnerabilities in PHP (an open-source programming…

13. Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.
    Hacker News Front Page 22 Oct 2026, 10:11 UTC Software Engineering

    I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly…

14. The race to the first exploit // php2shell
    LiveOverflow 22 Oct 2026, 00:44 UTC Cyber — Video

    💾 I used Codex and the hints from Calif's public demo to try to rediscover the PHP remote code execution vulnerability behind php2shell. I just wanted to make this video to document an example AI workflow in October 2026. Will be…

15. PHP2Shell: GitLab helps find and remediate critical PHP flaws
    GitLab Blog 22 Oct 2026, 00:00 UTC DevOps & SRE

    GitLab is not affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The GitLab application is not written in PHP and does not run it to serve web requests, and our Security team has found no evidence of impact to GitLab-managed…

16. Web site: PHP high-risk loophole repaired, OpenAI leads coordination of global discovery/rehabilitation
    IT Home (EN Mirror) 21 Oct 2026, 23:11 UTC Hardware Translated from zh-cn
17. AI found flaws in the code behind 70% of the web. The fix took two months.
    The New Stack 21 Oct 2026, 22:17 UTC Cloud & Infrastructure

    PHP powers roughly 70% of the world’s websites , according to Wiz Research , so a flaw in its core engine affects much more than any single application. On Wednesday, researchers disclosed two critical vulnerabilities discovered with help…

18. PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
    Hacker News Front Page 21 Oct 2026, 21:12 UTC Software Engineering

    Article URL: https://aws.amazon.com/security/security-bulletins/2026-143-aws/ Comments URL: https://news.ycombinator.com/item?id=50187708 Points: 107 # Comments: 26

19. PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
    SecurityWeek 21 Oct 2026, 16:50 UTC Cybersecurity

    Several cybersecurity companies saw exploitation attempts of CVE-2026-109618 and CVE-2026-109619 before PHP released the patches. The post PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors appeared first on SecurityWeek .

20. PHP2Shell: Why websites are going offline for emergency security updates
    Malwarebytes Labs 21 Oct 2026, 16:14 UTC Cybersecurity

    If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking…

21. Widespread PHP Flaw May Cause Many Site Outages Today
    Krebs on Security 21 Oct 2026, 15:26 UTC Cybersecurity

    Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say…