Unverified50% confidenceFactExact time
The PHP core has a remotely exploitable memory vulnerability through which attackers can gain root access, and both vulnerabilities have a CVSS score of 9.2.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/22/2026
First Seen
Valid until: 1/20/2027
Sources
When the NSA Gets Involved: The AI Supply Chain Crisis Behind Open-Source CVEs and API Key Hijacking
youtubeTheo - t3․gg10/22/2026
Related Entities
Related Claims
UnverifiedPHP has been disclosed to have two critical-severity security vulnerabilities.78% similarUnverifiedPHP core vulnerabilities can lead to remote code execution or information disclosure, with common types including out-of-bounds memory access, use-after-free and integer overflow.74% similarUnverifiedPHP2Shell is described as a vulnerability affecting the software behind about 70% of websites.68% similarUnverifiedCredential stuffing attacks refer to attackers automatically attempting to use username-password combinations leaked from one breach to log in to other websites in order to take over accounts.68% similarUnverifiedPHP officially fixed two high-severity vulnerabilities that allow remote code execution without authentication, numbered CVE-2026-109618 and CVE-2026-109619.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1087332API
curl https://kongchang.com/api/v1/knowledge/claims/1087332MCP
get_claim(id=1087332)