5 casos · pág. 1/1
Two critical vulnerabilities in the PHP language, each rated CVSS 9.2, allow unauthenticated remote code execution on vulnerable servers. Governments and companies reportedly took sites offline as a precaution. The PHP Foundation released four updates on 21 October 2026. One flaw was first identified by a researcher in 2024, and the Found…
On October 21, the PHP Foundation released a Critical PHP Security release fixing two critical remote code execution vulnerabilities, collectively referred to as PHP2shell. Cisco published an advisory on how these flaws affect its products and rated the security impact Critical. The excerpt does not list which Cisco products are affected,…
A cluster of unrelated but concurrent security events hit on 21 October 2026. Reuters reported government websites worldwide going offline after AI-discovered critical vulnerabilities in PHP, and the NSA advised organizations to update immediately or take PHP systems offline. The same day, Node.js patched four high-severity flaws, and Lit…
Patchstack reports a critical remote code execution vulnerability in PHP that is already being actively exploited after details leaked on October 20. Because the flaw sits in the language runtime, any PHP-based application on a vulnerable version is exposed, including WordPress, Drupal, Magento, Joomla and Laravel sites. Patchstack confir…
The PHP security team released emergency fixes on October 21, 2026 at 14:00 UTC for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials a…
