{"id":"ECHO-3b6e-9e7f-34fe","upstream":["CVE-2026-109618"],"severity":[],"modified":"2026-10-21T16:28:58.421Z","affected":[{"package":{"ecosystem":"Echo","name":"php-8.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.35+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.2-zts"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.35+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.36+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.3-zts"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.36+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.27+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.4-zts"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.27+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.12+e1"}]}]},{"package":{"ecosystem":"Echo","name":"php-8.5-zts"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.12+e1"}]}]}],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-109618"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618"},{"type":"WEB","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"},{"type":"WEB","url":"https://www.wiz.io/blog/php2shell-php-rce"}]}