Unverified50% confidenceFactExact time
According to the timeline disclosed on Wiz's official blog: the first vulnerability was discovered on August 19, the exploitability of unauthenticated RCE on Drupal and WordPress was confirmed on August 20 and 21 respectively, and it was reported to the PHP security team on August 24.
1
Sources
50%
Confidence
Long-term
Relevance
10/21/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThere is a window of about 24 hours between the leak of the CVE IDs and the patch release, during which sites running PHP 8.x face increased exposure risk.66% similarUnverifiedThe PHP Foundation blog states that at about 20:00 UTC after the pre-announcement was published, the security company Calif mistakenly made public a proof-of-concept video that demonstrated the exploitation process against multiple targets and revealed a small amount of additional vulnerability detail.63% similarUnverifiedPHP officially released a security update on October 21, 2026 covering the entire PHP 8.x series, fixing two vulnerabilities that can lead to remote code execution.62% similarUnverifiedPHP officially fixed two high-severity vulnerabilities that allow remote code execution without authentication, numbered CVE-2026-109618 and CVE-2026-109619.61% similarUnverifiedThe affected products involved in the five newly added vulnerabilities are: the ProFTPD file read/write vulnerability (severity 10.0), ONLYOFFICE Docs path traversal (9.8), Apache Struts command injection (8.1), BIND denial of service (7.5), and Strapi plaintext exposure (7.2).59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1082888API
curl https://kongchang.com/api/v1/knowledge/claims/1082888MCP
get_claim(id=1082888)