Blog · 2-hour update · 2026-10-28

CVE-2026-109618 PHP: exploited in the wild, how to patch

By the PatchTheCVE security team · Updated 2026-10-28 · Data from NVD, CISA KEV, EPSS and vendor advisories

On 28 October 2026, 12 new CVEs were published that we track: 1 critical, 4 already exploited in the wild (CISA KEV) and 2 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

Key takeaways

• Most urgent: CVE-2026-109618 (PHP): upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12.
• 4 exploited in the wild (CISA KEV): patch these before anything else.
• 5 of the top 8 can be attacked over the network without a login.
• 2 of 12 new CVEs already have a fix or vendor patch.
• Most affected vendors: king-theme, zorem.

What happened in this 2-hour window: the most serious item is CVE-2026-109618 in php (critical, CVSS 9.8, priority 97/100). Recommended action: upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12. 4 new CVEs from the list below are already being exploited (CVE-2026-109618, CVE-2026-111497, CVE-2026-109619, and more), so those go first. 5 of the 8 top items can be attacked remotely without a login. Most affected: king-theme (1), zorem (1). 2 of 12 new CVEs already have a fix or vendor patch; for the other 10, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-109618: PHP Memory Corruption Vulnerability

• Risk: Critical (CVSS 9.8), priority 97/100 (patch now), published 21 October 2026
• Exploitation: exploited in the wild (CISA KEV), federal due date 2026-10-29; 100.0% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
• Affected: php php (>= 7.3.0 and < 8.2.35, >= 8.3.0 and < 8.3.36, >= 8.4.0 and < 8.4.27)
• Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12
• Patch ID: RHSA-2026:87070, RHSA-2026:87071, RHSA-2026:88561
• What to do: upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12 for php php

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Mitigation, Vendor Advisory

CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability

• Risk: Critical (CVSS 9.2), priority 90/100 (patch now), published 22 October 2026
• Exploitation: exploited in the wild (CISA KEV), federal due date 2026-11-10; 55.5% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
• Affected: Google Brotli
• Patch ID: RHSA-2026:10767, RHSA-2026:19131, RHSA-2026:90449
• What to do: apply the vendor mitigation for Google Brotli

Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD

CVE-2026-109619: PHP Stale Internal Request-State Vulnerability

• Risk: High (CVSS 8.1), priority 86/100 (patch now), published 21 October 2026
• Exploitation: exploited in the wild (CISA KEV), federal due date 2026-10-29; 100.0% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
• Affected: php php (>= 5.4.0 and < 8.2.35, >= 8.3.0 and < 8.3.36, >= 8.4.0 and < 8.4.27)
• Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12
• Patch ID: RHSA-2026:87070, RHSA-2026:87071, RHSA-2026:88561
• What to do: upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12 for php php

Why it ranks here: high severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Mitigation, Vendor Advisory

CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

• Risk: Critical (CVSS 9.3), priority 82/100 (patch now), published 14 July 2026
• Exploitation: exploited in the wild (CISA KEV), federal due date 2026-11-10; 30.6% chance of exploitation in the next 30 days (EPSS)
• Affected: adobe commerce (>= 1.6.0 and < 1.21.0)
• Fixed in: 1.21.0
• What to do: downgrade to a release before 2.4.4 until a fix ships for adobe commerce

Why it ranks here: critical severity; epss top 2%: very likely to be exploited; exploited in the wild (cisa kev).

References: NVD · Vendor Advisory

CVE-2026-104384: Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versio

• Risk: High (CVSS 8.7), priority 35/100 (routine), published 28 October 2026
• Exploitation: attackable over the network without a login
• What to do: apply the vendor mitigation

Why it ranks here: high severity; remotely exploitable, no login, no user action.

References: NVD

CVE-2026-104383: Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on

• Risk: Critical (CVSS 9.4), priority 33/100 (patch this month), published 28 October 2026
• What to do: apply the vendor mitigation

Why it ranks here: critical severity.

References: NVD

CVE-2026-1928: The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Inj

• Risk: High (CVSS 8.8), priority 31/100 (routine), published 28 October 2026
• What to do: apply the vendor mitigation

Why it ranks here: high severity.

References: NVD

CVE-2026-116613: The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to

• Risk: High (CVSS 7.5), priority 31/100 (routine), published 28 October 2026
• Exploitation: attackable over the network without a login
• What to do: apply the vendor mitigation

Why it ranks here: high severity; remotely exploitable, no login, no user action.

References: NVD

Most affected vendors

• king-theme: 1 new CVE
• zorem: 1 new CVE

How to act on this list

1. Start with anything marked exploited or patch now.
2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 28 October 2026?

CVE-2026-109618 (PHP Memory Corruption Vulnerability) ranks highest, with a priority score of 97/100. Recommended action: upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12.

Are any of the new CVEs exploited in the wild?

Yes, 4 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

• NIST National Vulnerability Database: CVE details and affected versions
• CVE Program: official CVE records
• CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
• FIRST EPSS: exploit probability
• Distribution and vendor advisories linked under each item.

Keep reading

• Patch now: the highest-priority CVEs
• CVEs exploited in the wild (CISA KEV)
• Exploited this week
• Windows KB updates by version
• Software A to Z
• Patching guides for Linux, Windows, pip and npm
• Check my software against these CVEs

← All posts