Cydra Research

Detections, tools and write-ups.

Each write-up comes in two parts: a brief for leadership and a deep-dive for analysts. Both come with detection rules, scanners and queries that we've tested in a lab before publishing.

October 22, 2026 · PHP · 2× CVSS 9.2

CVE-2026-109618 & 109619: the PHP bugs you can't code your way out of

Two engine-level RCEs, fixed by one update, that affect every PHP site on an unpatched server. Includes a fleet scanner, a host posture check, eight Suricata rules and SIEM correlation queries.

Read the write-up →