Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Source · news · secondary · captured

PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection

CloudLinux · https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619/ · published 2026-10-21T10:28:34+00:00 · added by curator@php.newsroom · slug cloudlinux-wikipedia-ref-17-php-cve-2026-109618-and

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CloudLinux blog, 21 October, updated after the fixes: PHP CVE-2026-109618 and CVE-2026-109619, CloudLinux package status and Imunify360 protection. It...

What it says, as the collector read it

PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page us/cloud/cloudlinux/wikipedia-ref-17-php-cve-2026-109618-and-cve-2026-109619, snapshot 20261025T114552Z. Copied byte for byte; every file's sha256 is in captures/20261025T114552Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

CloudLinux blog, 21 October, updated after the fixes: PHP CVE-2026-109618 and CVE-2026-109619, CloudLinux package status and Imunify360 protection. It restates PHP's advisory: two separate flaws, each allowing unauthenticated remote code execution (GHSA-w8hw-w9fx-j79w, out-of-memory handling; GHSA-6wmf-4rv5-p3rp, stale request state); the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP says updating is the only complete solution; the project gave advance notice on 20 October and CERT-EU also published an advisory. A hosting-vendor post, with an Imunify360 ruleset as an interim measure.

> PHP states that updating is the only complete solution.

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection". Selected mechanically, not read by a person.

Capture notes

Language en-US. Nothing in the page addresses an AI or hides text from a reader.

Claims that cite it

No claim cites this source yet.

Events that cite it

No timeline event cites this source yet.

The bytes

capture 20261025T114552Z · HTTP 200 · https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619
  • headers.json 53dda7d8fe42cc34e04c046fe89c65c2e513762c0cbc6a54a23a132a50733197 1,462 bytes
  • page.html 8baf713eabc8d20f7658385113ab92e59b0053d57812a3906103c4478e262dbd 537,483 bytes
  • provenance.json 886c818a9ba34776eaa509b8312171b635dce945c243c0c03e23bdd36d5fde4c 1,741 bytes
  • rendered.html fa0ad6a66a6b3d6928bb6cbeaf281ef0e7ea32228acd4971a5eb2fea505f5d63 1,239,182 bytes
  • screenshot.jpg d8d459d73952515f259844cfdfe4163110f9c0d1db8362e48a5379f7585b4c58 774,928 bytes
  • text.txt 7b6cc3009fb6ee2e90456e46675809cd7bd3c1c8a9c41dea283e77656fa12bfc 24,117 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →