CVE-2026-109619 Archives • Daily CyberSecurity

Do Son October 29, 2026

Dream researchers uncovered a Chinese-nexus PHP2Shell exploit Fragnesia chain that rooted 25 firewalls and breached a US government Active Directory.

CISA Adds PHP2Shell to KEV as Confirmed RCE Attacks and Suspected DPRK Scanning Surface PHP2Shell added to CISA KEV catalog after confirmed RCE and suspected DPRK scanning

Do Son October 27, 2026

CISA adds PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to the CISA KEV catalog after confirmed RCE and suspected DPRK-linked scanning.

PHP2Shell: List of Affected Products PHP2Shell affected products list including PAN-OS, QNAP, Cisco and Citrix with fix status

Do Son October 26, 2026

PHP2Shell affected products list: vendor patch status for CVE-2026-109618 and CVE-2026-109619 across PAN-OS, QNAP, Cisco, Citrix, F5 and more.

Palo Alto Networks Confirms PHP2Shell Flaws Affect PAN-OS and Panorama PAN-OS PHP2Shell vulnerabilities affect Palo Alto Networks firewall management interface

Do Son October 23, 2026

Palo Alto confirms PAN-OS PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 affect the firewall management interface. Restrict access and patch.

PHP Warns of New Session Upload Progress Flaw CVE-2026-115560, Urges Mitigation PHP session vulnerability CVE-2026-115560 in session upload progress after PHP2Shell

Do Son October 23, 2026

PHP warns of CVE-2026-115560, a PHP session vulnerability that follows PHP2Shell. Disable session.upload_progress until the next bugfix release.

cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers cPanel PHP update fixes PHP2Shell flaws and WP Toolkit vulnerability

Do Son October 22, 2026

A cPanel PHP update fixes PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, while WP Toolkit 6.11.5 patches CVE-2026-107663.

QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline QNAP PHP2Shell vulnerabilities affect QTS and QuTS hero NAS devices

Do Son October 22, 2026

QNAP PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect QTS, QuTS hero and apps. No patch yet, so take NAS devices offline.

PHP2Shell Exploited in the Wild as PoC Exploits and Full Details Go Public PHP2Shell remote code execution flaws exploited in the wild after PoC release

Do Son October 22, 2026

PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now.

PHP Releases Fixes and Full Details for Two Critical Unauthenticated RCE Flaws PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution

Do Son October 21, 2026

PHP fixes two critical PHP RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing remote code execution. Update to 8.5.12 or 8.4.27.

PHP Prepares Emergency Fix as Cloudflare Reports Early Attacks on Critical Flaws PHP security release for critical remote code execution flaws CVE-2026-109618 and CVE-2026-109619

Do Son October 20, 2026

Cloudflare reports early attacks on two critical PHP flaws ahead of the PHP security release fixing remote code execution bugs CVE-2026-109618.