4 casos · pág. 1/1
Two critical vulnerabilities in the PHP engine, collectively dubbed PHP2Shell, were fixed in emergency security releases on October 21, 2026 after details leaked ahead of the planned disclosure (darkreading.com, itsecurityguru.org). Amazon Web Services (AWS) honeypot logs show at least one actor attempting exploitation from October 17, fo…
CrowdStrike published a blog post on 2026-10-21, authored by Amit Serper, titled "CrowdStrike Protects Customers from Threats Delivered via PHP2Shell". The text provided contains only the headline and site navigation, with no article body. The URL slug references PHP RCE zero-days, but the provided content does not confirm vulnerability d…
Wiz Research disclosed multiple memory-safety vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, and patched by the PHP team on October 21, 2026. The flaws allow unauthenticated remote code execution or disclosure of process memory (passwords, tokens, API keys, certificates) on any site running an…
The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…
