Unverified50% confidenceEventExact time
PHP officially fixed two high-severity vulnerabilities that allow remote code execution without authentication, numbered CVE-2026-109618 and CVE-2026-109619.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/21/2026
First Seen
Valid until: 11/4/2026
Sources
Related Entities
Related Claims
UnverifiedPHP has been disclosed to have two critical-severity security vulnerabilities.73% similarUnverifiedPHP2Shell is a publicly disclosed exploit chain that can chain multiple flaws in PHP applications into a complete remote code execution (RCE) path.68% similarUnverifiedAF_UNIX GC 代码历史上曾多次引发安全问题，包括 CVE-2021-0920 和 CVE-2024-108666% similarUnverifiedAdvisory SNWLID-2026-0017 also contains three authenticated vulnerabilities: CVE-2026-102256 (post-authentication OS command injection, score 7.8), CVE-2026-102257 (Zip Slip path traversal, score 7.2), and CVE-2026-102258 (stored XSS, score 5.5).66% similarUnverifiedCVE-2026-92392 is a use-after-free vulnerability originating from curl mishandling an HTTP/2 RST_STREAM sent by the server; when the reason is HTTP_1_1_REQUIRED or REFUSED_STREAM, it causes a use-after-free of struct Curl_easy.65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1082628API
curl https://kongchang.com/api/v1/knowledge/claims/1082628MCP
get_claim(id=1082628)