CVE-2026-109618

waiting for further signals

no check availablenot proven exploitable

awaiting cvepublic poc−4h32mkev

PHP security team PHP

ETK-2026-2243, permanent identifier

cvss9.0ethiack provisional

47msince last run

34mAI analysis

timeline

0 = cve.org, not yet published

trigger signal −10h41mpublic poc−4h32mwaiting for further signals−0h47m

−10h

−8h

−6h

−2h

description

PHP is the affected component, but the available evidence does not identify the flaw class, affected function, or affected versions. The evidence also does not establish what an attacker can do or what access or configuration precondition is required.

mitigation

Monitor official PHP security announcements and apply the emergency updates as soon as the relevant releases are published. Reduce exposure by limiting public access to PHP-backed services where operationally feasible until affected versions are identified.

check

exploit

automation

–

auth required

–

EPSS

–

agent run time

34m

cve.org record, t = 0

not published yet

Δ to public poc

−4h32m

Δ to kev

–

outcome

No artifact: an exploit or check was attempted but could not be produced at this moment.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-20 20:56Z
bleepingcomputer: trigger signal, started the run
https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
2026-10-20 20:56Z
PHP warns admins of two critical flaws, emergency patches coming tomorrow
bleepingcomputer · https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
2026-10-21 06:18Z
Zer061/CVE-2026-109618
github · https://github.com/Zer061/CVE-2026-109618

this entry in the feed

GET /api/v1/feed/CVE-2026-109618

{
  "etk_id": "ETK-2026-2243",
  "cve_id": "CVE-2026-109618",
  "display_id": "CVE-2026-109618",
  "ghsa_id": null,
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Reported vulnerability in PHP security team PHP",
  "summary": "PHP is the affected component, but the available evidence does not identify the flaw class, affected function, or affected versions. The evidence also does not establish what an attacker can do or what access or configuration precondition is required.",
  "mitigation": "Monitor official PHP security announcements and apply the emergency updates as soon as the relevant releases are published. Reduce exposure by limiting public access to PHP-backed services where operationally feasible until affected versions are identified.",
  "vendor": "PHP security team",
  "product": "PHP",
  "affected": [],
  "cwes": null,
  "cvss_score": 9,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 34.39083506666667,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-21T03:06:03+00:00",
      "days": -0.18893601418981482,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T07:38:07.107489+00:00",
      "url": "https://github.com/Zer061/CVE-2026-109618"
    },
    "trigger_signal": {
      "at": "2026-10-20T20:56:43+00:00",
      "days": -0.4454174956712963,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T07:38:07.107489+00:00",
      "url": "https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/"
    }
  }
}

published 2026-10-21 00:23Z
last change 2026-10-21 07:37Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.