5 casos · pág. 1/1
PHP maintainers released emergency patches for two critical memory corruption flaws, collectively called PHP2shell (CVE-2026-109618 and CVE-2026-109619), that allow unauthenticated remote code execution. The PHP Foundation accuses Chainguard of breaking the coordinated disclosure embargo on 21 October at 07:41 UTC, more than six hours bef…
PHP released an emergency update for two critical zero-day vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They allow remote code execution, denial of service and data exposure, and are reportedly already being exploited in the wild. Nearly 70 percent of websites are said to need updating, and Reuters reports that government website…
Two critical vulnerabilities in the PHP language, each rated CVSS 9.2, allow unauthenticated remote code execution on vulnerable servers. Governments and companies reportedly took sites offline as a precaution. The PHP Foundation released four updates on 21 October 2026. One flaw was first identified by a researcher in 2024, and the Found…
Wiz Research disclosed multiple memory-safety vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, and patched by the PHP team on October 21, 2026. The flaws allow unauthenticated remote code execution or disclosure of process memory (passwords, tokens, API keys, certificates) on any site running an…
The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…
