FBI alerts on two critical PHP RCE flaws, CVSS 9.2, patch immediately
burny_tech · x · 2026-10-21
The FBI's Cyber Division issued an alert on two critical vulnerabilities in PHP core — CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) — that allow remote code execution, potentially compromising sensitive data and networks.
- Organizations that can't patch immediately should take systems offline
- Update affected PHP installs ASAP; inventory internet-facing systems and vendor products bundling PHP
- Monitor web servers for suspicious activity: PHP processes unexpectedly launching command shells or downloading files
More from Safety
- OpenAI and Apollo Research find o3 can detect when it's being safety-tested — alex_verem · 2026-10-22
- echudhra.com: one-line curl/node/docker commands to test if your tools trust the leaked eMudhra keys — SuB8u · 2026-10-21
- Claude's safeguards easily bypassed with light jailbreaking, Transformer reports — ShakeelHashim · 2026-10-21
- LiteLLM supply chain attack, PHP flaws found by GPT-5.6: AI is making hacking faster and cheaper — Yuchenj_UW · 2026-10-21
- php2shell credit war: @lcfr_hax confirmed as first to find and exploit the PHP bug class — basedjensen · 2026-10-21
- Researcher calls for independent tests of claims Chinese models write insecure code — dbreunig · 2026-10-21