Explore the impact of PHP core vulnerabilities CVE-2026-109618 and CVE-2026-109619 affecting PHP 7.x and 8.x releases.
With a CVSS score of 9.2 allowing pre-authentication remote code execution, the PHP Foundation advanced patch releases following an early proof-of-concept leak.
The first moves and action before publication
Amazon's security team detected an attempt to exploit the vulnerabilities on October 17, 2026. The attack targeted a special trap system maintained by the company and originated from a web address connected to a commercial anonymity network. Researchers from companies including Calif, OpenAI, and Wiz, which is owned by Google, discovered the vulnerabilities, which affect every release of PHP in the 7 and 8 series.
The premature leak and the acceleration of corrections
The official disclosure of the issues was scheduled for October 22, 2026. However, details and ready-made attack tools were leaked earlier, resulting in the foundation that manages PHP releasing the fixes a day earlier.
After the leak, Amazon recorded multiple attack attempts from various hidden addresses, starting on October 21, 2026. On the same day, ELLIO detected the first similar movement on its systems, after ready-made software images with the fixes had been published.
READ ALSO
New serious security flaw can bring down web servers with a single connection
Who is affected and why it matters
Security companies like CrowdStrike have reported that these attacks leave almost no digital footprint, such as stolen sessions or traces of tampering. At the same time, threat intelligence organizations have found that millions of computers and servers across the internet are running older and vulnerable versions.
Internet service providers have had to block tens of thousands of suspicious requests that were looking for the vulnerabilities. International cybersecurity organizations, such as the United States' CISA and the United Kingdom's NCSC, along with a number of technology companies, have called on organizations to implement the updates without delay.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)