CVE-2026-109619: PHP Group PHP

1. A public proof of concept: reached 2026-10-21

• Canadian Centre for Cyber Security (CCCS), citing open-source reporting reached, 2026-10-21

  third-party text, as Pulse recorded it
  The Cyber Centre has observed open-source reporting indicating that a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.

  Pulse: An agency relaying open-source reporting that a PoC is available (alert AL26-026, dated October 21, 2026). Not a PoC Pulse has seen; PoC code is never fetched.
  capture watch:oq9gflln: raw/ca/cert/cccs/cccs-al26-026/20261022T171501Z/text.txt, 22 October 2026, 17:15 UTC, sha256 9e7f44cc73e21ad5 original
• The Hacker News reached, 2026-10-22

  third-party text, as Pulse recorded it
  Originally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTC, details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time, prompting the PHP Foundation to move the release forward by one day.

  Pulse: Press report that a PoC leaked before the release; the article is dated Oct 22, 2026.
  capture watch:oq9gflln: raw/in/tech-press/the-hacker-news/thehackernews-php2shell-4days/20261022T181608Z/text.txt, 22 October 2026, 18:16 UTC, sha256 273acad7dd739f2e

2. A nuclei template that exploits rather than only fingerprints: not reached

3. A merged Metasploit module: not reached

4. Exploitation attempts reported by a named party: reached 2026-10-21

• watchTowr (its own page) reached, 2026-10-21

  third-party text, as Pulse recorded it
  October 21, 2026: watchTowr’s Attacker Eye honeypot network observed exploitation of CVE-2026-109618 and CVE-2026-109619 in the wild.

  Pulse: A named security firm reporting exploitation seen on its honeypot network: attempts against honeypots, not a compromise of a named victim.
  capture watch:oq9gflln: raw/sg/research/watchtowr/watchtowr-php2shell/20261022T181608Z/text.txt, 22 October 2026, 18:16 UTC, sha256 55a97edaa433ea7d
• Amazon Threat Intelligence (MadPot), as reported by Infosecurity Magazine reached, 2026-10-22

  third-party text, as Pulse recorded it
  Now the patches have been released, the Amazon Threat Intelligence team has publically confirmed they observed a PHP2Shell exploitation attempt dating October 17. The attempt occurred in MadPot, an internal honeypot system created by Amazon Web Services (AWS) to monitor, study and disrupt global cybercrime.

  Pulse: A named party reporting an attempt against its honeypot, relayed by the press. The flaws are named as PHP2Shell, not by CVE.
  capture watch:oq9gflln: raw/gb/news/infosecurity-magazine/news-php2shell-exploitation-attempt/20261022T171501Z/text.txt, 22 October 2026, 17:15 UTC, sha256 4e502c06c4a4da1d

Reported, not established

• Canadian Centre for Cyber Security (CCCS) contradicted, 2026-10-21

  third-party text, as Pulse recorded it
  with no active exploitation being identified at this time, but that can change quickly.

  Pulse: An agency saying, the same day, that it had identified no active exploitation. Recorded beside the reports above, not weighed against them.
  capture watch:oq9gflln: raw/ca/cert/cccs/cccs-al26-026/20261022T171501Z/text.txt, 22 October 2026, 17:15 UTC, sha256 9e7f44cc73e21ad5 original

5. A KEV listing (the date added): not reached

6. knownRansomwareCampaignUse: Known on KEV: not reached

7. A national CERT reporting compromises in its country: not reached

8. A named organisation saying it was compromised through that flaw: not reached

a victim's own statement is recorded by hand from a capture; none recorded

Reported, not established

• ČVUT (Czech Technical University), quoted by Lupa.cz reported, not established, 2026-10-22

  third-party text, as Pulse recorded it
  ČVUT v současnosti řeší kybernetický útok na svou IT infrastrukturu. Jedná se o součást celosvětových pokusů zasáhnout weby s technologií PHP. Aktivní útok se podařilo zastavit

  Pulse: A named organisation describing an attack, part of worldwide attempts against PHP sites, that was stopped: an attempt, not a stated compromise through the flaw. Lupa.cz adds it is not yet clear the outage relates to PHP2Shell. Read from the watch's contradiction compromise-cvut, open.
  capture watch:oq9gflln: raw/cz/tech-press/lupa/cvut-cyber-attack/20261022T191510Z/text.txt, 22 October 2026, 19:15 UTC, sha256 0a0abb12fccb6fbc
• DMM, via Sankei reported, not established, 2026-10-21

  third-party text, as Pulse recorded it
  to respond to a vulnerability found in external software (as summarised in the watch; DMM would not confirm a link to PHP)

  Pulse: A named company's emergency maintenance, no stated link to PHP. Read from the watch's contradiction compromise-dmm, open.
  capture watch:oq9gflln: raw/jp/news/sankei/dmm-service-halt/20261022T191536Z/text.txt, 22 October 2026, 19:15 UTC, sha256 8baf5de68d8527ed
• GMO Internet Group, via J-CAST / Yahoo! News Japan reported, not established, 2026-10-20

  third-party text, as Pulse recorded it
  Unauthorised programs found on 20 October on some servers (as summarised in the watch); the article does not name PHP or php2shell

  Pulse: A confirmed compromise of named systems with no stated cause. Coincidence in time is not attribution. Read from the watch's contradiction compromise-gmo-fx-vps, open.
  capture watch:oq9gflln: raw/jp/news/yahoo-news-jp/gmo-fx-login-leak/20261022T191523Z/text.txt, 22 October 2026, 19:15 UTC, sha256 f3823c3f22ffbc12
• Valtec, via INTERNET Watch retracted, 2026-10-22

  third-party text, as Pulse recorded it
  PHPの脆弱性を標的としたサイバー攻撃 (first statement) / 我々のサービス自体の脆弱性 (correction)

  Pulse: A first attribution to the PHP flaw, corrected by the company the same day: its own service's flaw was exploited. Read from the watch's contradiction compromise-valtec, resolved.
  capture watch:oq9gflln: raw/jp/tech-press/impress-watch/valtec-php-attack/20261022T191433Z/text.txt, 22 October 2026, 19:14 UTC, sha256 8eb3458dda2e5e8f