PHP releases emergency fixes for 2 critical vulnerabilities | CyberScoop

PHP releases emergency fixes for 2 critical vulnerabilities | CyberScoop

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page ie/news/cyberscoop/php-emergency-patches-php2shell-vulnerabilities, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

CyberScoop, 21 October: PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, both 9.2 on CVSS v4.0, described by researchers as remote code execution flaws that could let an attacker run code on a server and potentially take control. It says that, after 24 hours of alarm, there had been very little reported exploitation as of Wednesday afternoon.

> there has been very little in terms of reported exploitation as of Wednesday afternoon

Why it is here

From the promotion queue (index/promote.json, priority 3): Mentions CVE-2026-109618/109619 or php2shell: "PHP releases emergency fixes for 2 critical vulnerabilities | CyberScoop". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

Capture notes

Language en-US. Nothing in the page addresses an AI or hides text from a reader.