- Published
- Source
- Huntress
- Reported by
- 12 publishers
- Filed under
- Data breaches, SOC & SIEM, Attacks
- Vulnerabilities
- 2 CVEs
Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.
Think your details were in it?
- Check your email address at Have I Been Pwned – it lists the breaches your details have appeared in.
- Change that service's password, and any other account that used the same one. A password manager makes every password unique.
- Turn on two-step verification, and expect scam messages that quote the leaked details to sound convincing.
More helpHave I Been Pwned (opens in a new tab)NCSC: top tips for staying secure online (opens in a new tab)
Also reported by 6 more publishers
The vulnerabilities in this story
CVE-2026-109618 in the NVD (opens in a new tab)
- CVSS9.8Critical
- CISA KEVNot listedno confirmed exploitation on CISA’s list (yet)
CVE-2026-109619 in the NVD (opens in a new tab)
- CVSS9.8Critical
- CISA KEVNot listedno confirmed exploitation on CISA’s list (yet)
Exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog (CC0). Exploit prediction: EPSS by FIRST. This product uses the NVD API but is not endorsed or certified by the NVD.
MyCyberWay training
Blue Team Analyst
Every story here started as an alert. Learn to triage them.
Our Blue Team Analyst programme prepares you for a first SOC role: 26 live classes in UK hours, an alert queue worked in Microsoft Sentinel, and a full SOC shift simulation at the end. No security experience needed to start.
- Triage and KQL in Microsoft Sentinel
- Identity, endpoint, email and network investigations
- A verifiable digital badge
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
