3 casos · pág. 1/1
Amazon Web Services (AWS) research indicates that at least one actor began attempting to exploit two critical PHP vulnerabilities, collectively called PHP2Shell, on October 17. That was four days before the fixes and public disclosure on Wednesday, October 21, at 10 am ET. AWS found the activity by reviewing honeypot logs. The attempt cam…
Two critical vulnerabilities affect PHP, in all versions since PHP 5 (2004). The NSA warned about them on Wednesday 21 October 2026, saying they let attackers reach the server file system or the database used by the web application (techcrunch.com). The PHP Foundation released four updates on 21 October 2026, including PHP 8.5.12. Each fl…
The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…
