Vendor hub

PHP Group vulnerabilities

Dossiers

CVE-2026-109619, CVE-2026-109618CRITICAL

PHP2Shell: unauthenticated RCE in PHP web SAPIs (CVE-2026-109618, CVE-2026-109619)

Two critical PHP request-handling bugs allow unauthenticated RCE; in KEV and exploited against PAN-OS management interfaces, chained with Fragnesia for root.

Updated 2026-11-09

Recent CISA KEV entries

CVE	Product	Added to KEV	Status	Dossier
CVE-2026-109618	PHP Group PHP	2026-10-26	Active exploitation	Chain dossier →
CVE-2026-109619	PHP Group PHP	2026-10-26	Active exploitation	Chain dossier →
CVE-2024-4577	PHP Group PHP	2024-06-12	Active exploitation	Planned