Skip to content
brandefense.io
Request A Demo
Trending Vulnerabilities

Why it is trending

CVE-2026-10961

Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity:

Emerging
  • CVSS 8.3
  • Public PoC
Buzz
60discussion, 0-100
Danger
38exploitability, 0-100
Mentions
7since 20 Oct 2026
EPSS
0.3%exploit probability
Mentions Per Day · UTCpeak 5
29 days agoToday
Where The Talk Is · by platform7 total
  • GitHub6 mentions · 6 voices · 2 PoC
  • Reddit1 mentions · 1 voices · 1 PoC
Newest Public Posts · plain text, newest first

GitHub

  • al4n4n/php2shell: php2shell 100% work DoS in Wordpress. CVE-2026-109618 and CVE-2026-10961

    al4n4n/php2shell2 d agostars 1PoCOpen

  • GitHub cross-source: enactive-systems/CVE-2026-109618-poc:

    enactive-systems/CVE-2026-109618-poc2 d agostars 37Open

  • GitHub cross-source: junaire/CVE-2026-109618-exploit:

    junaire/CVE-2026-109618-exploit3 d agostars 111Open

  • GitHub cross-source: eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC: Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.

    eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC3 d agostars 747Open

  • GitHub cross-source: Zer061/CVE-2026-109618: PoC CVE-2026-109618 / -109619 (PHP session.upload_progress heap UAF)

    Zer061/CVE-2026-1096183 d agostars 61Open

  • dinosn/php-cve-2026-10961x-lab-poc: PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12

    dinosn/php-cve-2026-10961x-lab-poc3 d agostars 105PoCOpen

Reddit

  • CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window — Leak hit HN 2026-10-20 15:20Z. PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 fix both CVEs. Mechanism: php_request_startup() calls php_hash_environment() (multipart parse, the session.upload_progress callback, php_se…

    r/netsec47 h agoPoCOpen
Public PoC Repositories · third-party code2 links

Links are collected from public posts and are not reviewed by Brandefense. Exploit code can be unsafe or malicious: only study it in an isolated lab, and never run it against systems you do not own.

Get a morning brief and an alert the moment a critical vulnerability like this one starts trending.

Subscribe