CVE-2026-109618
PHP Memory Corruption Vulnerability
9.8CVSS base score · critical (NVD)
100%Chance of exploitation in the next 30 days (FIRST EPSS)
ExploitedIn CISA KEV · federal patch deadline Oct 29, 2026
What happened
CISA added CVE-2026-46300 to the Known Exploited Vulnerabilities catalog. A missing variable initialization in Linux Kernel's socket buffer coalescing can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and execute commands as root. Apply patches immediately per BOD 26-04 guidelines. Federal due date: October 31, 2026.
From the Intel60 brief of Oct 28, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalLinux Kernel variable initialization flaw enables ESP RCEOct 28, 2026