[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqJ7mOXCInnEf2iurniT_KpM8WgEWnrTFixefBJ-SEyE":3},{"article":4,"iocs":50,"watch_terms":57,"solutions":58,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b4b10767-1f26-4f22-a25c-fdffdbf40090","Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)","threat-brief-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619-upd-cb1bde","CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared first on Unit 42.","Unit 42 has identified two critical remote code execution vulnerabilities in PHP, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), with CVSS scores of 9.2. These vulnerabilities allow attackers to achieve RCE by exploiting out-of-memory errors or fatal error handling that leaves global memory pointing to freed regions. The vulnerabilities are being actively exploited, chained with a Linux kernel privilege-escalation vulnerability to gain root access, and have been observed targeting internet-exposed PAN-OS management interfaces.","Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, are being actively exploited.","https:\u002F\u002Funit42.paloaltonetworks.com\u002Fcve-2026-109618-cve-2026-109619\u002F","https:\u002F\u002Funit42.paloaltonetworks.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002F03_Vulnerabilities_1920x900.jpg","2026-10-29T18:00:34+00:00","2026-10-31T10:00:31.917227+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"PAN-OS","product",{"name":21,"type":22},"Palo Alto Networks","vendor",{"name":24,"type":19},"Cortex Xpanse",{"name":26,"type":19},"Cortex XDR",{"name":28,"type":19},"Cortex XSIAM",{"name":30,"type":31},"PHP","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,40,45],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55],{"type":52,"value":53,"context":54},"cve","CVE-2026-109618","Critical vulnerability in PHP",{"type":52,"value":56,"context":54},"CVE-2026-109619",[21,18,24],{"controls":59,"vendors":140},[60,89,111],{"slug":61,"name":62,"problem":63,"products":64},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":90,"name":91,"problem":92,"products":93},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png","watchtowr-platform","watchTowr Platform","https:\u002F\u002Fwatchtowr.com\u002Fplatform\u002F","Continuous discovery of internet-facing assets, with automated testing for exploitable vulnerabilities.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},{"slug":112,"name":113,"problem":114,"products":115},"patch-management","Automated patch management","Known holes get closed in days, not months.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",[141],{"slug":142,"name":21,"logo_path":143,"roles":144},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[145,146],"reported_by","affected",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":159},"critical-php-rce-vulnerabilities-actively-exploited-for-root-access-via-kernel-chain","Critical PHP RCE Vulnerabilities Actively Exploited for Root Access via Kernel Chain","Two critical remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), scoring 9.2 on the CVSS scale, are being actively exploited in the wild. Attackers exploit unsafe memory handling — specifically out-of-memory errors and fatal error handling that leaves global memory pointing to freed regions — to execute arbitrary code. These flaws are being chained with a Linux kernel privilege-escalation vulnerability to achieve full root access, with confirmed targeting of internet-exposed PAN-OS management interfaces. This incident highlights the compounding danger of unpatched application-layer vulnerabilities when combined with kernel-level weaknesses, and the critical importance of restricting public exposure of management interfaces.",[152,153,154,155,156,157,158],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":160,"PCI DSS Requirement 6":161,"NIST SP 800-53 SI-2: Flaw Remediation":162,"OWASP A06:2021 Vulnerable and Outdated Components":163,"CIS Control 7: Continuous Vulnerability Management":164,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":165,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":166},"NIS2 requires essential and important entities to implement vulnerability handling and patching policies, making the failure to patch these critical PHP vulnerabilities a potential compliance breach.","PCI DSS Requirement 6 mandates the development and maintenance of secure systems by applying security patches promptly, which directly applies to the unpatched PHP runtime exploited in these attacks.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule, directly mandating the rapid patching of these critical PHP RCE vulnerabilities.","Running unpatched versions of PHP on internet-facing servers is exactly the scenario OWASP A06 addresses, emphasizing the need to track and update all third-party components including language runtimes.","Routine vulnerability scanning and a defined patching cadence would have identified the critical PHP flaws and driven timely remediation before active exploitation began.","A.8.8 requires timely identification and remediation of technical vulnerabilities, which would have enforced a structured response to these publicly disclosed, actively exploited PHP flaws.","Restricting access to management interfaces so they are not internet-exposed aligns with PR.AA controls, which would have significantly limited the attack surface exploited in this campaign."]