CVE-2026-109619

Corroboration timeline

Each row is the first time that source reported this CVE, so the lag column shows how long each took relative to the earliest report. Corroboration across distinct sources is a confidence signal that a single advisory cannot give you.

1. elastic-security-labs2026-10-21 00:00 UTCfirst report

   php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619

2. sophos-news2026-10-21 00:00 UTCsame time

   Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

3. huntress-blog2026-10-21 04:00 UTC+4h

   Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

4. fortinet-psirt2026-10-21 07:00 UTC+7h

   PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)

5. tenable-advisories2026-10-21 09:01 UTC+9h

   php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

6. sans-isc2026-10-21 13:02 UTC+13h

   Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)

7. unit422026-10-21 13:40 UTC+14h

   Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619

8. nvd-cve2026-10-21 14:17 UTC+14h

   CVE-2026-109619 — PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may

9. securelist2026-10-21 15:18 UTC+15h

   Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

10. rapid7-blog2026-10-21 15:22 UTC+15h

    CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

11. palo-alto-psirt2026-10-21 16:00 UTC+16h

    CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)

12. splunk-advisories2026-10-22 00:00 UTC+24h

    SVD-2026-1013: Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026

13. cisa-kev2026-10-26 00:00 UTC+5d

    CVE-2026-109619 — PHP Group PHP: PHP Stale Internal Request-State Vulnerability

How this page is built

ThreatFilter ingests 52 public threat-intelligence feeds. A page is published here only when at least 3 distinct sources report the same CVE — roughly 0.2% of the CVEs seen. Everything above is derived from those feeds; nothing is hand-written, and the timeline is the raw record of what each source published and when.

See the live advisory feed, the full source list, or the analyst tools.