PHP Remote Code Execution (CVE-2026-109618 & CVE-2026-109619)
Information about two new remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS v3.1 10 / 10), has leaked ahead of their coordinated disclosure, and security firm Watchtowr Labs confirmed that the flaws are real. Both vulnerabilities are due to be disclosed on Thursday, October 22, alongside patches. Until those advisories land, no fix is available, which leaves the flaws as zero-days in PHP installations everywhere.There is currently a scheduled release of an advisement and possible patch on Wednesday, October 21 2026 at 14:00 UTC.
Below is a video of a researcher, maybe the original researcher, showcasing the exploits.
#CTI #BlueTeam #ThreatIntel #CVE-2026-109618 #CVE-2026-109619
🚨 Five critical flaws in WordPress plugins and themes can lead to site takeover or RCE.
The bugs span auth bypass, admin password-reset exposure, privilege escalation, and server-side code execution across GiveWP, Avada, WPMU DEV, TranslatePress, and Pods.
Read: https://t.co/64JznSNamA
@himachalpolice B: the domain name url and https
checking url is important because domain name registration is varified so you can verify yourself that you have visited the site you intend to.
also website needs to be using HTTPS protocol for secure website connection.