{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/security-release/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-109618"},{"id":"CVE-2026-109619"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PHP (affected versions not yet confirmed)"],"_cs_severities":["critical"],"_cs_tags":["php","security-release"],"_cs_type":"advisory","_cs_vendors":["PHP Group"],"content_html":"\u003cp\u003eThe PHP security team announced an upcoming release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. It scheduled the release for 21 October 2026 at 14:00 UTC and said it will disclose technical details, affected versions, and fixed versions with that release. CERT-EU identifies the issues as CVE-2026-109618 and CVE-2026-109619. CERT-EU describes potential remote code execution based on other reporting; PHP has not yet confirmed that attack path. No active exploitation is established in the cited notices.\u003c/p\u003e\n\u003ch2 id=\"detection-opportunity\"\u003eDetection opportunity\u003c/h2\u003e\n\u003cp\u003eHunt for PHP or web-server workers spawning shells, scripting runtimes, discovery commands, or network utilities. The \u003ca href=\"https://gist.github.com/hazcod/71712c0bfe5abf191cbc87245c27fcb8\"\u003ecommunity Sigma rule for suspicious PHP child processes\u003c/a\u003e offers a starting point across Linux, macOS, and Windows. It requires process creation telemetry with both parent and child executable paths; use command lines and nearby HTTP requests to investigate matches. Tune known application jobs that intentionally start command-line tools.\u003c/p\u003e\n\u003cp\u003eThis is generic post-execution behavior. A match does not establish exploitation of CVE-2026-109618 or CVE-2026-109619, and execution that stays inside the PHP worker will not match this rule.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify deployed PHP runtimes and the public applications that depend on them so owners can patch promptly.\u003c/li\u003e\n\u003cli\u003eWatch the PHP security release for confirmed affected and fixed versions; test and roll out the relevant updates.\u003c/li\u003e\n\u003cli\u003eTreat claims that all PHP versions are affected or that unauthenticated remote code execution is confirmed as provisional until the vendor publishes technical details.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T07:47:00Z","date_published":"2026-10-21T07:47:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-php-critical-security-release/","summary":"PHP has announced two critical vulnerabilities rated CVSS v4.0 9.2 and a security release scheduled for 21 October at 14:00 UTC. Exploit details and affected versions are not yet confirmed by PHP.","title":"PHP: Two critical vulnerabilities ahead of scheduled security release","url":"https://feed.craftedsignal.io/briefs/2026-10-php-critical-security-release/"}],"language":"en","title":"CraftedSignal Threat Feed - Security-Release","version":"https://jsonfeed.org/version/1.1"}