Mmastodon TechnologyCybersecurity first seen 8 h ago, last 8 h ago, peak #10
Critical PHP flaw exploited in the wild as weekly security roundup lands
Original: Weekly roundup, Oct 19–25: - PHP2Shell CVE-2026-109618/-109619 (CVSS 9.2): fixed 8.5.12/8.4.27/8.3.36/8.2.35; probes sin
A weekly cybersecurity roundup for Oct 19–25 highlights PHP2Shell, two critical vulnerabilities in PHP tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2. Fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but exploit probes have been observed since Oct 17. Defenders are urged to patch and then hunt for suspicious new .php files in upload and cache directories and PHP_SESSION_UPLOAD_PROGRESS POST requests. The roundup also notes fresh KEV additions, including Arista VCO CVE-2026-114625 and a Collabora flaw.
Why now: Active exploitation probes of a critical PHP vulnerability make urgent patching a hot topic among security teams this week.
PHPAristaCollaboraCVE-2026-109618CVE-2026-109619
Evidence
- Weekly roundup, Oct 19–25: - PHP2Shell CVE-2026-109618/-109619 (CVSS 9.2): fixed 8.5.12/8.4.27/8.3.36/8.2.35; probes since Oct 17. After patching, hunt new .php files in upload/cache dirs and PHP_SESSION_UPLOAD_PROGRESS POSTs - KEV: Arista VCO CVE-2026-114625, Collabora… · tpsecurity@infosec.exchange · 1
API: https://socialmediatrends-api.osmike.com/v1/trends/3662917