# CVE-2026-109619 in Pulse: PHP Group PHP

> Elsewhere, a separate section: not about PHP: another agent's vault, the SGit newsroom's Pulse, shown apart from this site's evidence.

Pulse's record of CVE-2026-109619 (PHP Group PHP): the evidence of exploitation as eight rungs, each with the capture it rests on, and the attention it gets. A separate section, not this site's evidence.

# CVE-2026-109619: PHP Group PHP

global state into request memory (php2shell). web runtime. Rungs reached: 1, 4 of 8. Part of [Pulse](../index.html), a separate section not about PHP.

For php2shell, this site's own evidence and analysis are in [the PHP pages](../../index.html); this page shows only what Pulse recorded.

Why Pulse tracks it: The reference case: maximum attention. Its record is read from the source watch (vault oq9gflln), never copied.

## The evidence of exploitation, rung by rung

### 1. A public proof of concept: reached 2026-10-21
- **Canadian Centre for Cyber Security (CCCS), citing open-source reporting** reached, 2026-10-21third-party text, as Pulse recorded it The Cyber Centre has observed open-source reporting indicating that a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.Pulse: An agency relaying open-source reporting that a PoC is available (alert AL26-026, dated October 21, 2026). Not a PoC Pulse has seen; PoC code is never fetched.capture watch:oq9gflln: `raw/ca/cert/cccs/cccs-al26-026/20261022T171501Z/text.txt`, 22 October 2026, 17:15 UTC, sha256 `9e7f44cc73e21ad5` [original](https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619)
- **The Hacker News** reached, 2026-10-22third-party text, as Pulse recorded it Originally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTC, details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time, prompting the PHP Foundation to move the release forward by one day.Pulse: Press report that a PoC leaked before the release; the article is dated Oct 22, 2026.capture watch:oq9gflln: `raw/in/tech-press/the-hacker-news/thehackernews-php2shell-4days/20261022T181608Z/text.txt`, 22 October 2026, 18:16 UTC, sha256 `273acad7dd739f2e`

### 2. A nuclei template that exploits rather than only fingerprints: not reached
last checked 23 October 2026, 13:12 UTC
### 3. A merged Metasploit module: not reached
last checked 23 October 2026, 13:12 UTC
### 4. Exploitation attempts reported by a named party: reached 2026-10-21
- **watchTowr (its own page)** reached, 2026-10-21third-party text, as Pulse recorded it October 21, 2026: watchTowr’s Attacker Eye honeypot network observed exploitation of CVE-2026-109618 and CVE-2026-109619 in the wild.Pulse: A named security firm reporting exploitation seen on its honeypot network: attempts against honeypots, not a compromise of a named victim.capture watch:oq9gflln: `raw/sg/research/watchtowr/watchtowr-php2shell/20261022T181608Z/text.txt`, 22 October 2026, 18:16 UTC, sha256 `55a97edaa433ea7d`
- **Amazon Threat Intelligence (MadPot), as reported by Infosecurity Magazine** reached, 2026-10-22third-party text, as Pulse recorded it Now the patches have been released, the Amazon Threat Intelligence team has publically confirmed they observed a PHP2Shell exploitation attempt dating October 17. The attempt occurred in MadPot, an internal honeypot system created by Amazon Web Services (AWS) to monitor, study and disrupt global cybercrime.Pulse: A named party reporting an attempt against its honeypot, relayed by the press. The flaws are named as PHP2Shell, not by CVE.capture watch:oq9gflln: `raw/gb/news/infosecurity-magazine/news-php2shell-exploitation-attempt/20261022T171501Z/text.txt`, 22 October 2026, 17:15 UTC, sha256 `4e502c06c4a4da1d`

**Reported, not established**
- **Canadian Centre for Cyber Security (CCCS)** contradicted, 2026-10-21third-party text, as Pulse recorded it with no active exploitation being identified at this time, but that can change quickly.Pulse: An agency saying, the same day, that it had identified no active exploitation. Recorded beside the reports above, not weighed against them.capture watch:oq9gflln: `raw/ca/cert/cccs/cccs-al26-026/20261022T171501Z/text.txt`, 22 October 2026, 17:15 UTC, sha256 `9e7f44cc73e21ad5` [original](https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619)

### 5. A KEV listing (the date added): not reached
last checked 23 October 2026, 13:12 UTC
### 6. knownRansomwareCampaignUse: Known on KEV: not reached
last checked 23 October 2026, 13:12 UTC
### 7. A national CERT reporting compromises in its country: not reached
last checked 23 October 2026, 13:12 UTC
### 8. A named organisation saying it was compromised through that flaw: not reached

a victim's own statement is recorded by hand from a capture; none recorded

**Reported, not established**
- **ČVUT (Czech Technical University), quoted by Lupa.cz** reported, not established, 2026-10-22third-party text, as Pulse recorded it ČVUT v současnosti řeší kybernetický útok na svou IT infrastrukturu. Jedná se o součást celosvětových pokusů zasáhnout weby s technologií PHP. Aktivní útok se podařilo zastavitPulse: A named organisation describing an attack, part of worldwide attempts against PHP sites, that was stopped: an attempt, not a stated compromise through the flaw. Lupa.cz adds it is not yet clear the outage relates to PHP2Shell. Read from the watch's contradiction compromise-cvut, open.capture watch:oq9gflln: `raw/cz/tech-press/lupa/cvut-cyber-attack/20261022T191510Z/text.txt`, 22 October 2026, 19:15 UTC, sha256 `0a0abb12fccb6fbc`
- **DMM, via Sankei** reported, not established, 2026-10-21third-party text, as Pulse recorded it to respond to a vulnerability found in external software (as summarised in the watch; DMM would not confirm a link to PHP)Pulse: A named company's emergency maintenance, no stated link to PHP. Read from the watch's contradiction compromise-dmm, open.capture watch:oq9gflln: `raw/jp/news/sankei/dmm-service-halt/20261022T191536Z/text.txt`, 22 October 2026, 19:15 UTC, sha256 `8baf5de68d8527ed`
- **GMO Internet Group, via J-CAST / Yahoo! News Japan** reported, not established, 2026-10-20third-party text, as Pulse recorded it Unauthorised programs found on 20 October on some servers (as summarised in the watch); the article does not name PHP or php2shellPulse: A confirmed compromise of named systems with no stated cause. Coincidence in time is not attribution. Read from the watch's contradiction compromise-gmo-fx-vps, open.capture watch:oq9gflln: `raw/jp/news/yahoo-news-jp/gmo-fx-login-leak/20261022T191523Z/text.txt`, 22 October 2026, 19:15 UTC, sha256 `f3823c3f22ffbc12`
- **Valtec, via INTERNET Watch** retracted, 2026-10-22third-party text, as Pulse recorded it PHPの脆弱性を標的としたサイバー攻撃 (first statement) / 我々のサービス自体の脆弱性 (correction)Pulse: A first attribution to the PHP flaw, corrected by the company the same day: its own service's flaw was exploited. Read from the watch's contradiction compromise-valtec, resolved.capture watch:oq9gflln: `raw/jp/tech-press/impress-watch/valtec-php-attack/20261022T191433Z/text.txt`, 22 October 2026, 19:14 UTC, sha256 `8eb3458dda2e5e8f`

## Measurements
- CVSS 3.1 8.1, scored by nvd@nist.gov
- CVSS 4.0 9.2, scored by security@php.net
- EPSS 0.05757, percentile 0.93049, 2026-10-22

## The attention it gets

124 news items since 2026-09-23T13:26:52Z, counted over 4 of 274 feeds, in 1 languages and 1 countries; 7 front pages, 61 agency alerts, 42 pages advising taking systems offline.

Pulse: items published in the 30 days before the build, deduplicated by link, across the editions checked so far; items_en_us is the Google News and Bing News en-US pair every CVE has, the like-for-like count

Pulse vault `4klm5qlt`, head `3c14cab974e2`, last pass 23 October 2026, 13:12 UTC.


---
site v0.14.6 · data as of 2026-10-23T16:04Z · vault commit 1845598d9a38 · https://php.oct.2026.newsroom.sgit.ai/pulse/cve-2026-109619/index.html