{"id":"ECHO-1cb9-f463-f8da","upstream":["CVE-2026-109619"],"severity":[],"modified":"2026-10-21T16:28:58.421Z","affected":[{"package":{"ecosystem":"Echo","name":"php-8.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.35+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.2-zts"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.35+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.36+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.3-zts"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.36+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.27+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.4-zts"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.27+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.12+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.5-zts"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.12+e1"}]}]}],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-109619"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109619"},{"type":"WEB","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"type":"WEB","url":"https://www.wiz.io/blog/php2shell-php-rce"}]}