php2shell (CVE-2026-109618, CVE-2026-109619): FAQ about critical PHP remote code execution flaws
On October 20, CVE identifiers for two critical vulnerabilities in PHP began circulating on Hacker News and social media. Later that day, the PHP security team published an advance notice of an emergency security release scheduled for October 21 at 14:00 UTC. Public reporting describes both as remote code execution vulnerabilities, and a video credited to researcher LCFR and Calif.io demonstrates an exploit chain dubbed php2shell. CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 Cloudflare CTO Dane Knecht said the company is seeing early attacks emerging. For more information about the vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.Oracle October 2026 Critical Patch Update Addresses 1209 CVEs
On October 20, Oracle released its Critical Patch Update (CPU) for October 2026, the final quarterly update of 2026. This CPU contains fixes for 1209 unique CVEs in 1295 security updates across 33 Oracle product families. Out of the 1295 security updates published, 8.6% of patches were assigned a critical severity. Medium severity patches accounted for the bulk of security patches at 47.3%, followed by high severity patches at 36.7%. For more information about the October 2026 CPU release, including the availability of patches and Tenable product coverage, please visit our blog.
