- Published
- Source
- Kaspersky
- Reported by
- 13 publishers
- Filed under
- Awareness, Malware & exploits
- Vulnerabilities
- 2 CVEs
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) pose a risk to home users and their data. We explain the danger and how to stay protected.
If you run the affected product
- Find every instance – especially the ones reachable from the internet.
- Apply the vendor's patch or mitigation now: exploited flaws are fixed in days, not at the next patch cycle.
- Then check for signs it was used before you patched: web shells, new accounts, unusual outbound traffic.
More helpCISA's Known Exploited Vulnerabilities catalogue (opens in a new tab)
Also reported by 6 more publishers
The vulnerabilities in this story
CVE-2026-109618 in the NVD (opens in a new tab)
- CVSS9.8Critical
- CISA KEVNot listedno confirmed exploitation on CISA’s list (yet)
CVE-2026-109619 in the NVD (opens in a new tab)
- CVSS9.8Critical
- CISA KEVNot listedno confirmed exploitation on CISA’s list (yet)
Exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog (CC0). Exploit prediction: EPSS by FIRST. This product uses the NVD API but is not endorsed or certified by the NVD.
MyCyberWay training
Blue Team Analyst
Every story here started as an alert. Learn to triage them.
Our Blue Team Analyst programme prepares you for a first SOC role: 26 live classes in UK hours, an alert queue worked in Microsoft Sentinel, and a full SOC shift simulation at the end. No security experience needed to start.
- Triage and KQL in Microsoft Sentinel
- Identity, endpoint, email and network investigations
- A verifiable digital badge
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
