[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQsHNp3fFbAUE9OyqMweVRlgbb02eyLVQBzbrfDMXC5k":3},{"article":4,"iocs":41,"watch_terms":51,"solutions":52,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"adf471d6-9f33-40cc-ae00-89d4728e214b","CVE-2026-109618 \u002F CVE-2026-109619 | NodeZero Rapid Response Check Now Available","cve-2026-109618-cve-2026-109619-nodezero-rapid-response-check-now-available-3d44a5","Advisory for PHP2Shell (CVE-2026-109618 and CVE-2026-109619): affected PHP versions, fixed releases, mitigations, monitoring guidance, and the NodeZero Rapid Response check.","Critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution and have been patched by PHP on October 21, 2026. NodeZero has released a rapid response check to help identify affected systems, urging immediate patching, especially for internet-facing infrastructure. Exploitation attempts are ongoing, with varying success depending on system configurations.","PHP Core RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 are critical, with NodeZero offering a rapid response","https:\u002F\u002Fhorizon3.ai\u002Fattack-research\u002Fvulnerabilities\u002Fcve-2026-109618-cve-2026-109619\u002F","https:\u002F\u002Fhorizon3.ai\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FAI-Accelerated-Exploitation-red.png","2026-10-23T17:50:00+00:00","2026-10-23T20:00:07.527661+00:00",9,[17,20],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"NodeZero","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,46,48],{"type":43,"value":44,"context":45},"cve","CVE-2026-109618","PHP Core Remote Code Execution Vulnerability",{"type":43,"value":47,"context":45},"CVE-2026-109619",{"type":43,"value":49,"context":50},"CVE-2026-115560","PHP Session Upload Progress Vulnerability",[21,18],{"controls":53,"vendors":140},[54,83,111],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,96,103],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":84,"product_name":100,"url":101,"description":102},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":112,"name":113,"problem":114,"products":115},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[141],{"slug":142,"name":143,"logo_path":144,"roles":145},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png",[146],"reported_by",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":159},"critical-php-rce-vulnerabilities-demand-immediate-patching-of-internet-facing-systems","Critical PHP RCE Vulnerabilities Demand Immediate Patching of Internet-Facing Systems","Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution, meaning attackers can compromise systems without any credentials whatsoever. The patch was made available on October 21, 2026, yet exploitation attempts are already ongoing, highlighting the dangerous window between patch release and deployment. Internet-facing infrastructure running unpatched PHP is at immediate risk of full system compromise. This incident underscores that delays in applying security patches — even by days — can have catastrophic consequences when vulnerabilities are actively being weaponized.",[152,153,154,155,156,157,158],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":160,"PCI DSS Requirement 6":161,"NIST SP 800-53 SI-2: Flaw Remediation":162,"CIS Control 17: Incident Response Management":163,"OWASP A06:2021 Vulnerable and Outdated Components":164,"CIS Control 7: Continuous Vulnerability Management":165,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":166},"NIS2 mandates incident handling and vulnerability management practices for essential entities; failure to patch critical internet-facing PHP infrastructure promptly constitutes a breach of this obligation.","Requirement 6 mandates that organisations develop and maintain secure systems by applying critical security patches within one month; these actively exploited CVEs would demand even faster action under this standard.","SI-2 requires organisations to identify, report, and correct information system flaws promptly; adherence would have mandated emergency remediation for these actively exploited RCE vulnerabilities.","With active exploitation underway, organisations need a practiced incident response plan to contain compromised PHP servers quickly and limit damage while patching is completed.","Running unpatched PHP directly matches this OWASP risk category, which warns that using components with known vulnerabilities enables attackers to exploit them — exactly what is occurring here.","A structured vulnerability management programme with defined patching timelines would have ensured the critical PHP patch was applied rapidly after its October 21 release, closing the exploitation window.","This control requires timely identification and remediation of technical vulnerabilities; a compliant programme would have flagged the PHP CVEs immediately upon disclosure and driven urgent patching."]