@wezm

- Java CVE-2026-91403

Oracle Security Alert Advisory – CVE-2026-91403 (eMudhra cert revocation)

https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

#security

sev:CRIT in Java really is the best way this week could continue on course.

https://www.cve.org/CVERecord?id=CVE-2026-91403

sev:CRIT 9.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Man, PHP has been getting its shit kicked in today. Well, at least the other language I grew up on is doing fine, right Java?

...Java?

oh. oh no.
https://www.cve.org/CVERecord?id=CVE-2026-91403

@wezm

- Java CVE-2026-91403

Oracle Security Alert Advisory – CVE-2026-91403 (eMudhra cert revocation)

https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

#security

sev:CRIT in Java really is the best way this week could continue on course.

https://www.cve.org/CVERecord?id=CVE-2026-91403

sev:CRIT 9.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Man, PHP has been getting its shit kicked in today. Well, at least the other language I grew up on is doing fine, right Java?

...Java?

oh. oh no.
https://www.cve.org/CVERecord?id=CVE-2026-91403

PHP2Shell is now under active exploitation

https://www.linkedin.com/posts/yesterday-information-leaked-about-two-share-7518682504153796609-1os5/

https://x.com/PrevidianCyber/status/2112936591719068048

https://x.com/OliverSild/status/2112823822411866215

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Der Patch sitzt. Die Frisur auch: Kritische Schwachstellen in PHP (CVE-2026-109618 und CVE-2026-109619).

#Nerdkram #Exploit

📰 Critical RCE Vulnerabilities in PHP Affect Millions of Web Servers

Two critical RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) in PHP with a 9.2 CVSS score. PoC exists. Over 22M instances exposed. Patching is urgent. #PHP #Vulnerability #CyberSecurity #RCE

🔗 https://cyber.netsecops.io/articles/critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

📰 Critical PHP2Shell RCE Flaws Leaked Ahead of Coordinated Patch

🚨 CRITICAL: Two RCE flaws in PHP dubbed "PHP2Shell" (CVE-2026-109618, CVE-2026-109619) were leaked before patches. Affects PHP 5.4+. Active exploitation is confirmed. Prepare for emergency patching now! #PHP #RCE #CyberSecurity

🔗 https://cyber.netsecops.io/articles/critical-php2shell-vulnerabilities-leaked-ahead-of-patch/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

https://aws.amazon.com/security/security-bulletins/2026-143-aws/

#aws #security

PHP fixed two remote code execution flaws today, CVE-2026-109618 and
CVE-2026-109619. Anything serving PHP is affected, whatever sits on top of it.

Two steps, and the second is missing from most of the advice going round:

1. Update PHP. 8.5.12, 8.4.27, 8.3.36, 8.2.35, or your distro's backport.
2. Restart PHP. A pool loads its binary once and serves from it until it
restarts, so the fix on disk reaches nothing already running.

PHP 8.1 is past end of life and gets no fix. Move those sites.

@mcc I don't know if this is any help at all, but here's the update statement from my web host.

https://clients.websavers.ca/whmcs/announcements/83/Vulnerability-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619---Mitigations-Applied.html

Patching PHP 7.4 for php2shell in a container

PHP 보안팀이 공개한 CVE-2026-109618(메모리 부족 상태의 손상)과 CVE-2026-109619(stale global state)은 웹 요청을 처리하는 PHP 환경에서 원격 코드 실행으로 이어질 수 있는 치명적 취약점이며, Apache mod_php 조합에서는 공개 PoC도 언급됐다. 글은 지원 종료된 PHP 7.4 공식 Docker 이미지에서 php-src의 최소 백포트 커밋을 적용하고, 기존 configure 옵션으로 PHP를 재빌드하는 Containerfile 절차를 제시한다. Debian 11 EOL에 따라 archive.debian.org로 APT 소스를 전환하고, 확장...

https://joshbowen.net/posts/patching-php-74-for-php2shell/

Your Sites Are Protected Against the PHP2Shell Vulnerabilities

PHP 프로젝트가 CVSS 9.2의 치명적 취약점 CVE-2026-109618·CVE-2026-109619(‘PHP2Shell’) 보안 업데이트를 공개했다. 인증 없이 일반 HTTP 요청만으로 PHP 런타임의 메모리 정리 오류를 악용해 원격 코드 실행(RCE)과 서버 장악으로 이어질 수 있으며, PHP 5.4 이후 버전과 WordPress·Drupal·Joomla의 최신 설치 사례에도 영향을 준다고 설명한다. 자체 운영 환경은 PHP 8.5.12, 8.4.27, 8.3.36 또는 8.2.35 이...

https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/

RE: https://infosec.exchange/@Spartan_1986/117480764972910966

So, that build date got me thinking. What if Canonical did implement the fix, but they are not reporting all the build digits? I know. That's stupid. But fortunately I can check on that. I've a Pro account and the server is, of course, registered with the Pro binary installed. You can force any CVE update with a the command "sudo pro fix CVE-YYYY-XXXX". So I ran the command for the two CVEs involved with this vuln. Here's what I got:

*******************************
$ sudo pro fix CVE-2026-109618
CVE-2026-109618: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109618

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109618 is resolved.
$ sudo pro fix CVE-2026-109619
CVE-2026-109619: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109619

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109619 is resolved.
*******************************

Damn it Canonical! Digits f-ing matter!!! Why do you have to be so stupid. I frankly don't even know if I can trust this. It should report the correct version with 'php -v' you numbskulls. This is why I got out of system administration in the first place.

Fixes for PHP CVE-2026-109618 and CVE-2026-109619 have either landed or are on their way.

Fixed versions:

- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35

Check https://build.alpinelinux.org for the current status of each builder, and https://pkgs.alpinelinux.org to see what is present in each repository.

https://pkgs.alpinelinux.org/packages?name=php%253F%253F&branch=v3.24 for example shows the current version of PHP on the v3.24 branch.

Rough Timeline of PHP2Shell

PHP의 CVE-2026-109618·CVE-2026-109619로 명명된 PHP2Shell 사태의 유출부터 패치 배포까지의 경과를 정리한 글입니다. 글에 따르면 두 취약점은 인증 없이 원격 코드 실행(RCE)을 허용하는 CVSS 10.0급 문제로, 패치 전에는 Cloudflare WAF 규칙과 서비스 중단 같은 임시 대응이 확산됐습니다. 공식 패치와 Docker 이미지가 PHP 8 계열에 우선 제공됐으며, PHP 7 이하 사용자는 PHP 8로 긴급 업그레이드하거나 서비스를 계속 격리해야 한다는 주장입니다. 다만 타임라인 내 PoC와 완화책의 유효성에 혼선이 있었다고 서술하므로, 운영자는 비공식 대응책에 의존하지 말고 PHP 보안 공지...

https://www.soeren.codes/articles/timeline-php2shell

A PHP2Shell stopgap "fix" until older PHP versions are updated

PHP2Shell(CVE-2026-109618, CVE-2026-109619)은 PHP 5.4 이후 버전의 mod_php·PHP-FPM·CGI 환경에 영향을 주는 CVSS 9.2의 인증 없이 가능한 원격 코드 실행 취약점이다. 패치 전 임시 완화책으로 웹 서버에서 `multipart/form-data` 요청을 차단하고, PHP `memory_limit`을 해제하며 업로드 진행 상태 기능을 비활성화하는 방법을 제안한다. 이 조치는 파일 업로드와 일부 폼을 중단시키고 메모리 고갈 위험을 높이므로 근본 해결책이 아니며, 배포판의 두 CVE 백포트 패치를 설치한 뒤 Apache/PHP-FPM을 재시작...

https://stuff.sigvaldason.com/php2sh.html

Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:

The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

🚨 PHP2Shell affects multiple vulnerabilities (CVE-2026-109618, CVE-2026-109619).

https://secdb.nttzen.cloud/updates/54fddaeb-7ada-4fa6-bd70-8117eff38bc9/php2shell-vulnerability

ℹ️ Additional details, sightings and PoC:

- CVE-2026-109618 - RCE via OOM corruption - https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618
- CVE-2026-109619 - RCE via stale global state - https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619

#InfoSec #PHP2Shell #RCE #CVE2026109618 #CVE2026109619
#NTTDATA #ZENSecDB

PHP2Shell is now under active exploitation

https://www.linkedin.com/posts/yesterday-information-leaked-about-two-share-7518682504153796609-1os5/

https://x.com/PrevidianCyber/status/2112936591719068048

https://x.com/OliverSild/status/2112823822411866215

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

https://aws.amazon.com/security/security-bulletins/2026-143-aws/

#aws #security

@mcc I don't know if this is any help at all, but here's the update statement from my web host.

https://clients.websavers.ca/whmcs/announcements/83/Vulnerability-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619---Mitigations-Applied.html

RE: https://infosec.exchange/@Spartan_1986/117480764972910966

So, that build date got me thinking. What if Canonical did implement the fix, but they are not reporting all the build digits? I know. That's stupid. But fortunately I can check on that. I've a Pro account and the server is, of course, registered with the Pro binary installed. You can force any CVE update with a the command "sudo pro fix CVE-YYYY-XXXX". So I ran the command for the two CVEs involved with this vuln. Here's what I got:

*******************************
$ sudo pro fix CVE-2026-109618
CVE-2026-109618: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109618

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109618 is resolved.
$ sudo pro fix CVE-2026-109619
CVE-2026-109619: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109619

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109619 is resolved.
*******************************

Damn it Canonical! Digits f-ing matter!!! Why do you have to be so stupid. I frankly don't even know if I can trust this. It should report the correct version with 'php -v' you numbskulls. This is why I got out of system administration in the first place.

Fixes for PHP CVE-2026-109618 and CVE-2026-109619 have either landed or are on their way.

Fixed versions:

- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35

Check https://build.alpinelinux.org for the current status of each builder, and https://pkgs.alpinelinux.org to see what is present in each repository.

https://pkgs.alpinelinux.org/packages?name=php%253F%253F&branch=v3.24 for example shows the current version of PHP on the v3.24 branch.

Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:

The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

🚨 PHP2Shell affects multiple vulnerabilities (CVE-2026-109618, CVE-2026-109619).

https://secdb.nttzen.cloud/updates/54fddaeb-7ada-4fa6-bd70-8117eff38bc9/php2shell-vulnerability

ℹ️ Additional details, sightings and PoC:

- CVE-2026-109618 - RCE via OOM corruption - https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618
- CVE-2026-109619 - RCE via stale global state - https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619

#InfoSec #PHP2Shell #RCE #CVE2026109618 #CVE2026109619
#NTTDATA #ZENSecDB

🔒 All LimeSurvey Cloud servers have been patched against the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 released today. No action is needed for our Cloud customers.

Running LimeSurvey yourself? Please update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 as soon as possible.

#LimeSurvey #PHP #Security #php2shell

Well, so far I have not been able to obtain PHP updates for Fedora 42, 43, and 44.

I am using this as a script:

#!/bin/bash

sudo dnf clean all
sudo dnf check-update php
sudo dnf update php\*

sudo dnf update

sudo systemctl restart php-fpm
# If using Apache:
sudo systemctl restart httpd
# If using Nginx:
# sudo systemctl restart nginx

rpm -q --changelog php-cli | grep -E "CVE-2026-109618|CVE-2026-109619"

Since AWS is feeling lackadaisical about all this... Is it believed that putting this in my php-fpm pools is sufficient?

; CVE-2026-109618
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 16M

; CVE-2026-109619
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[max_file_uploads] = 20
php_admin_value[fatal_error_backtraces] = 0

🚨 We just launched a free #PHP2Shell scanner!

PHP shipped the fix for CVE-2026-109618 & CVE-2026-109619, but attackers had a head start. Find out which of your servers still run a vulnerable version. No account required: https://pentest-tools.com/network-vulnerability-scanning/php2shell-scanner

If your target is vulnerable, you get a finding with the CVSS score, severity rating, and remediation guidance, downloadable as a PDF.

Before you call it patched:
🔍 PHP hides in control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
🙈 Servers that hide their PHP version won’t show up in scan results. Check those with php -v on the host
📦 Distro packages may carry the fix without changing the version number. Check your distro’s security advisory first
⛔ On PHP 8.1 or older? Upgrade to a supported branch. Building from source? PHP published minimal backports for 7.4, 8.0, and 8.1

Fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35.

#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking

New.

Palo Alto: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products https://security.paloaltonetworks.com/CVE-2026-109618 #infosec #PHP #vulnerability

@mttaggart

Major Web Site Security Alert!

PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update immediately.

CISA POST:
"CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. " https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching #Security #CISA #PHP #CVE
#php2shell #SecurityPatch #SecurityAdvisory #Software #Risk #RemoteCodeExecution #RCE #WebSites #Internet #Web #WWW #CyberSecurity #CyberDefence

OK, sorted.

If you previously followed my example and ran #shotshare (https://www.bentasker.co.uk/posts/blog/general/deploying-shotshare-into-kubernetes.html) you're likely to be vulnerable to #php CVEs CVE-2026-109618 and CVE-2026-109619

Upstream looks to be abandoned, so I've forked and reworked the docker image to consume the fix (PR against upstream: https://github.com/mdshack/shotshare/pull/87)

In the meantime, I've pushed to my registries

* codeberg.org/bentasker/shotshare:202610-php-cve-bump
* bentasker12/shotshare:202610-php-cve-bump

Should be drop-in replacements

Claims of the PHP vulns being EITW:

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.

Here is what you need to know:

* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 

* The root is a decades-old design choice in PHP's error handling (described more in our post)

* There was evidence of in-the-wild exploitation pre-disclosure. 

The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application

We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.

What to do right now:

The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.

Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012. 

The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours. 

Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.

Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.

Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com

Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618

We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

#php2shell #php #CVE #eitw

New.

Google: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619 #Google #infosec #vulnerability #PHP

PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, two critical RCE flaws with reported exploitation. Widespread PHP use raises risk of mass compromise and outages, so prioritize patching and hunt for post-exploit activity. #PhpSecurity #RemoteCodeExecution #PatchNow

https://cyberworldops.eu/en/emergency-php-updates-address-two-critical-rce-flaws-amid-exploitation

PHP has released emergency fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical memory safety flaws in the PHP runtime that can allow unauthenticated code execution.

Upgrade now to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

🔗 https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619

watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.

https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

#eitw #php #php2shell #CVE

For those running pfSense+ (and possibly pfSense CE), it seems like PHP packages are starting to roll out:

https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619/15

#pfSense

Der Preis für die dümmste Teaser-Einleitung rund um CVE-2026-109618 und CVE-2026-109619 geht ganz klar an die #futurezone ....

»Es sollen die bisher schwerwiegendsten Sicherheitslücken sein, die je durch Künstliche Intelligenz aufgespürt wurden.«
https://futurezone.at/digital-life/php2shell-luecke-openai-google-70-prozent-des-internets/403199916

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the...

🔗️ [Securelist] https://link.is.it/nPWHOU

PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

Comments: https://news.ycombinator.com/item?id=50182987

#HackerNews #PHPFoundation #CVE2026 #SecurityUpdates #OpenSource #PHPSecurity

The path to happiness and posterity runs through PHP. Here is some of the research dealing with that today - so far.

KrebsonSecurity: Widespread PHP Flaw May Cause Many Site Outages Today https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/ @briankrebs

Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core

Cisco: Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ @TalosSecurity

CrowdStrike: Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/

Kaspersky: Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/ @Kaspersky

Sophos: Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 @SophosXOps

Palo Alto: Millions of PHP Instances Exposed - What Organizations Need To Do Right Now https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/

VulnCheck: PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 https://www.vulncheck.com/blog/php2shell-vulnerabilities @vulncheck

Socket: PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline https://socket.dev/blog/php-critical-rce-patches @SocketSecurity

Rapid7: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/ @Rapid7Official #vulnerability #threatresearch #infosec

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

#php #CISA #CVE

🚨 Rapid Response: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), can allow unauthenticated remote code execution across multiple PHP server configurations.

Censys ARC observes:
🔸 2,580,515 Internet-exposed hosts and 54,888,147 web properties running PHP
🔸 1,575,688 hosts reporting PHP versions older than the fixed releases

These figures do not represent confirmed vulnerable systems. Security fixes may be backported without changing reported version strings.

PHP has released security updates and recommends upgrading immediately.

Full advisory and Censys queries: https://censys.com/advisory/cve-2026-109618-cve-2026-109619/

#CensysARC #Cybersecurity #VulnerabilityManagement #PHP #InfoSec

PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.

If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.

Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

Нескучный октябрь.

> В целях снижения риска эксплуатации уязвимостей CVE-2026-109618 и
CVE-2026-109619 мы отключаем директиву session.upload_progress.enabled.
Некоторые функции сайтов, касающиеся индикации загрузки файлов станут недоступны.
> Патч безопасности затронет версии PHP выше 8.1, поэтому, по возможности, обновитесь до
последних версий PHP.
> Для версий ниже исправлений нет.

> Служба технической поддержки компании .masterhost

@Argyle13

Regarding PHP2shell (CVE-2026-109618 and CVE-2026-109619) vulnerability, you obviously need to patch as quickly as possible but Cloudflare has implemented some mitigation's in it's default firewall that might buy you some time. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Hey! Five alarm #infosec fire! Government websites across Europe have been taken offline following the discovery of two critical security vulnerabilities in PHP, a programming language that underpins a massive portion of the internet.

On October 21, 2026, PHP developers announced emergency patches fixing two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, giving hackers the ability to take control of servers.

PHP is pervasive. It serves as the underlying engine for major content management systems like #WordPress, #Drupal and #Joomla.

Cybersecurity teams globally are being urged to immediately isolate any vulnerable, internet-facing PHP servers until official emergency updates (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) can be manually deployed.

Cloudflare has implemented temporary firewall mitigation rules, but experts stress this is only a stopgap measure.

Go patch your #php. Now.

https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/

Auf Grund der schwerwiegenden PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 sind meine Websites aktuell und für mehrere Stunden nicht erreichbar.

PHP fixes two critical PHP RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing remote code execution. Update to 8.5.12 or 8.4.27.

#PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ModPHP #PatchNow #CyberSecurity

https://securityonline.info/php-rce-vulnerabilities-cve-2026-109618-109619/?utm_source=mastodon&utm_medium=jetpack_social

The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

The php2shell fix is out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Two critical bugs (CVSS 9.2), both remote code execution without authentication. mod_php has the highest risk, but PHP-FPM and other SAPIs are affected too. There are source backports for 7.4, 8.0 and 8.1.

Update, then do a full restart, not a reload.

Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

#PHP #InfoSec #CVE

🚨 Critical pre-authentication RCE research published for two PHP core vulnerabilities; CVE-2026-109618 + CVE-2026-109619

PoC: https://github.com/ikow/php2shell-poc

The flaws affect PHP's session.upload_progress handling and can be chained through session-file injection, memory corruption, or deserialization behavior to achieve remote code execution under specific application conditions.

CVSS: 9.2 Critical
Affected: PHP 5.4.0 through 8.5.11
Fixed: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12

The repository includes verification PoCs for session injection, a heap use-after-free, and handler-mismatch deserialization, along with a vulnerable Docker lab and detailed technical analysis.

📣 Announcing the immediate availability of:

- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12

‼️ These address the following critical security issues:

- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
:windows8: Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

#php2shell landed:

https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Wheeeeeeeee!

Unser Provider empfiehlt deutlich, die PHP-Seiten per Firewall/deny all komplett offline zu nehmen… bin gespannt, was um 16h00 disclosed wird (scheint ja in Richtung multiform upload handler zu gehen) #PHP #CVE-2026-109618 #CVE-2026-109619

PHP InfoSec

Wise system administrators who have caught wind of this bug have taken measures already

It hasn't been patched yet but you can mitigate exposure of your systems.
Better yet, do what is written on tweakers.net

Quotes:

Make your store read-only or take it offline

If you can afford to take a PHP server offline for a day, do so. PHP core developer Gina Peter Banyard calls that the most sensible option. Several Dutch sites went offline as a precaution on October 21: tech site Tweakers, the House of Representatives (Tweede Kamer), the National Cyber Security Centre (NCSC) and security news site Security.NL.

Stop PHP-FPM and have your web server show a static maintenance page. The maintenance modes built into Magento and WordPress do not help: PHP still parses each request before the application checks for the maintenance flag.

If you cannot go offline, make the store read-only. Have your web server reject every request method other than GET and HEAD, for example in nginx:

if ($request_method !~ ^(GET|HEAD)$) {
return 503;
}

Quote:

Websites overnemen

De twee kritieke kwetsbaarheden in PHP (CVE-2026-109618 en CVE-2026-109619) hebben een score van 9,2 op de CVSS v4.0-schaal, die tot 10 gaat. Dat hoge cijfer is gebaseerd op de ernst van een kwetsbaarheid en op hoe makkelijk aanvallers die kunnen misbruiken. De kwetsbaarheden zouden al sinds versie 5.4.0 in PHP zitten, die in maart 2012 uitkwam. Aanvallers kunnen door de kwetsbaarheden eigen webpagina's publiceren. Daardoor kunnen zij mogelijk malware verspreiden. Daarnaast zou de zogeheten PHP2Shell-exploit het mogelijk maken om eigen code uit te voeren op kwetsbare servers.

Volgens verschillende beveiligingsadviezen kan het helpen om session.upload_progress.enabled uit te schakelen. Een bijbehorende tijdelijke oplossing zou zijn om session.use_strict_mode in te schakelen. Beveiligingsexpert Kevin Beaumont meldt dat de Linux-kernelbeveiligingsmodule AppArmor of SELinux ook bescherming biedt tegen misbruik van deze grote PHP-kwetsbaarheden.

I understand the NL language
Translate this if you don't

Jump to the sources read and work

Sources:

https://jackalsyn.com/posts/php-up-2026.html

https://sansec.io/research/php2shell

https://tweakers.net/

#PHP #bug #serious #infoSEC #programming #upgrade

🚨 If you run PHP (like most of the internet does), this one can’t wait: #PHP2Shell = 2 critical RCE flaws in PHP core leaked before the patch, with live attacks already reported.

Because CVE-2026-109618 & CVE-2026-109619 sit in PHP itself, every app on a vulnerable PHP version is exposed, no matter what runs on top.

That’s why we’re building detection in our Network Scanner + an exploit module in Sniper as you’re reading this. Stay tuned for the launch announcement!

What to do now:

Inventory every PHP install, including control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
Patch as soon as PHP’s release is out, then restart PHP-FPM or your web server
On PHP 8.1 or older? No fix is coming. Upgrade, or take those systems off the internet
Alert on PHP processes spawning shells, interpreters, or download tools

#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking

@thomasfuchs that's spooky. Remote-code execution 😬

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

> From what has been reported, the flaws are in how PHP processes file-upload requests. When a browser sends a form that contains a file, it uses a multipart/form-data request, which is a request body split into separate parts for each field and file. PHP reads and splits that body itself before your application code runs.

Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)
#CVE_2026_109618 #CVE_2026_109619
https://watchtowr.com/intelligence/php-cve-2026-109618-faq/

🔧 Dočasně vypínáme podporu přes FreeScout (helpdesk.oscloud.cz) kvůli kritické chybě v PHP. Znovu ji zapneme po aplikování opravy.

⚠️ Kritická zranitelnost v PHP, co to znamená pro OSCloud

PHP tým oznámil dvě kritické chyby (CVE-2026-109618 a CVE-2026-109619, obě CVSS 9.2). Mohou umožnit spuštění cizího kódu na serveru bez přihlášení. Oprava vychází dnes v 16:00 SEČ/CEST. Podle hlášení bezpečnostních firem už probíhají první útoky.

Kterých služeb se to týká:
• Nextcloud, WordPress, Pixelfed, FreeScout, a další aplikace postavené na PHP
• LAMP weby zákazníků (Apache + PHP), včetně těch, kde zatím běží jen úvodní stránka

Kterých ne:
• Mastodon, Matrix, PeerTube, Gitea (PHP nepoužívají)
• Weby a úložiště na statických souborech (Surfer)

Co děláme:
• FreeScout jsme vypnuli
• Další PHP aplikace a LAMP weby budeme vypínat postupně a vždy o tom budeme informovat zde. Počítejte s tím, že dočasně vypneme i Nextcloud, a to do vydání a nasazení opravy
• Jakmile budou dostupné opravené verze aplikací, nasadíme je co nejdřív
• Před vypnutím a updaty děláme zálohy

Co to znamená pro vás:
• Podpora přes FreeScout je do opravy nedostupná
• Nextcloud, LAMP weby a další PHP služby mohou být dnes nedostupné
• Pokud by se při updatu něco pokazilo, vracíme se ze zálohy maximálně 12 hodin zpět

Opravu nelze řešit pluginy ani updatem WordPressu, musí přijít nové PHP v rámci aktualizace aplikace. Pokud provozujete vlastní PHP web mimo OSCloud, aktualizujte PHP hned, jak vyjde oprava.

Děkujeme za trpělivost. Stav budeme průběžně aktualizovat v tomto vlákně.

#OSCloud #PHP #Bezpečnost

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) https://isc.sans.edu/diary/33440

Milhões de servidores PHP expostos ao risco da falha PHP2Shell. A recente divulgação de detalhes técnicos sobre as vulnerabilidades críticas no PHP (CVE-2026-109618 e CVE-2026-109619) acendeu os alertas no setor. 🚨

🔗 https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell

#apache #dados #equipa #falha #risco 

Die zentralen Websites der Uni Freiburg sind vom Netz genommen worden. #PHP

https://rz.uni-freiburg.de/de/rz/aktuell/stoerungen/2026-10-21-10-39-massnahme-im-zusammenhang-mit-der-kritischen-schwachstelle-php-cve-2026-109618-und-cve-2026-109619

php2shell: Dissecting PHP's Critical Session Upload Progress Vulnerabilities

CVE-2026-109618 & CVE-2026-109619 — From source code audit to three independent RCE chains

🔗️ [Substack] https://link.is.it/lp3FMf

CVE-2026-109618 & CVE-2026-109619: CRITICAL RCE in PHP (>=5.0.0). Patch lands Oct 21; only PHP 8.x supported. Mass exploitation likely post-release. Prepare to patch ASAP. Details: https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c #OffSeq #PHP #vuln #RCE

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress

Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.

🔗️ [Huntress] https://link.is.it/Q3tPnD

🚨 Critical Alert from Karen IT
Two critical unauthenticated RCE vulnerabilities in PHP (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) have leaked early.

https://ksrc.karenit.net/blog/security-alert/urgent-php-remote-code-execution-vulnerabilities-(cve-2026-109618-&-cve-2026-109619)

Do not delay.

#PHP #RCE #CVE #CyberSecurity

🚨 تنبيه حرج
ثغرتان حرجتان في PHP تسمحان بتنفيذ أكواد عن بُعد بدون مصادقة (CVE-2026-109618 و CVE-2026-109619، CVSS 9.2) تم تسريبهما مبكراً.
لا تتأخروا.

#PHP #ثغرات #أمن_سيبراني

PHP : deux failles critiques ont fuité avant l’heure, un correctif d’urgence arrive ce 21 octobre ! https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #PHP

#php2shell
Ok, dann werden wir mal unsere Server absichern, bis es entsprechende gepatchte Versionen von PHP gibt
Im Artikel sind entsprechende Maßnahmen gut beschrieben und erklärt, und auch, was nicht funktioniert.

Da ältere Versionen als #PHP82 keine Patches erhalten werden, muss ich diese wohl eben manuell absichern. (ja, ich nutze auch noch ältere Versionen)

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

#devadmin #serveradmin #cve #php #phpsecurity #phppatch #security

>当該脆弱性を悪用できると主張するコードが、既にインターネット上に出回り始めています（2026/10/21 14時 日本時間 追記）。

PHPの重大な脆弱性「php2shell」（CVE-2026...

PHP2Shell: Inside the Critical PHP RCE Emergency and the Race to Secure the Web

https://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/

@gunchleoc @GossiTheDog
Thanks, I updated my blog post mentioning heise and https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

I will not link to sources and you don't have to trust me, but there are already exploits out there, one of them will get you a shell on servers running WordPress. So this is a critical update. CVE-2026-109618 and CVE-2026-109619 seem to affect all PHP versions going back to 5.4 and could result in RCE (Remote Code Execution).

#SysAdminLife @homelab

@pulsar Thanks!

TL;DR: Details of two critical holes in PHP leaked before a fix was ready. They’re in how PHP handles file uploads and could let attackers run their own code on your server. Possibly affects PHP 5 through 8. Fixes are due today at 14:00 UTC, and attacks are expected within minutes of release.

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

The bug sits below WordPress or Laravel, so having no upload form doesn’t protect you, and nor do security plugins or maintenance mode.

Until the patch: list every server running PHP, including old staging sites. Switch off PHP’s upload-progress setting, and get your web server to refuse upload-style requests before they reach PHP. That breaks uploads for a few hours, which is the trade-off.

Once the fix lands: update every PHP version on every server, restart PHP and any background workers, and rebuild Docker images. PHP 8.1 and older won’t get a fix, so upgrade or take them offline. On managed hosting, ask your host to confirm.

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-111813/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-111813/

"No way to prevent this" say u...

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-111813/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-111813/

"No way to prevent this" say u...

A CVSS 10.0 E-Business Suite vulnerability, CVE-2026-101809, lets unauthenticated attackers take over Workflow. Oracle fixed 194 EBS flaws.

#Oracle #EBusinessSuite #CVE2026101809 #CVE2026101767 #PatchNow

https://securityonline.info/oracle-e-business-suite-vulnerability-cve-2026-101809/?utm_source=mastodon&utm_medium=jetpack_social

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

uh oh, 5, too many https://kb.isc.org/docs/cve-2026-94300

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-94300/

"No way to prevent this" say u...

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-94300/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

uh oh, 5, too many https://kb.isc.org/docs/cve-2026-94300

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-94300/

"No way to prevent this" say u...

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-94300/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

ISC fixes four BIND 9 vulnerabilities, including CVE-2026-94300 memory corruption and denial of service bugs. Upgrade to BIND 9.20.30 or 9.21.27.

#BIND9 #ISC #DNS #CVE202694300 #CVE202619630 #CVE202697313 #DenialOfService #CyberSecurity

https://securityonline.info/bind-9-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

PHP2Shell is now under active exploitation

https://www.linkedin.com/posts/yesterday-information-leaked-about-two-share-7518682504153796609-1os5/

https://x.com/PrevidianCyber/status/2112936591719068048

https://x.com/OliverSild/status/2112823822411866215

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Der Patch sitzt. Die Frisur auch: Kritische Schwachstellen in PHP (CVE-2026-109618 und CVE-2026-109619).

#Nerdkram #Exploit

📰 Critical RCE Vulnerabilities in PHP Affect Millions of Web Servers

Two critical RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) in PHP with a 9.2 CVSS score. PoC exists. Over 22M instances exposed. Patching is urgent. #PHP #Vulnerability #CyberSecurity #RCE

🔗 https://cyber.netsecops.io/articles/critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

📰 Critical PHP2Shell RCE Flaws Leaked Ahead of Coordinated Patch

🚨 CRITICAL: Two RCE flaws in PHP dubbed "PHP2Shell" (CVE-2026-109618, CVE-2026-109619) were leaked before patches. Affects PHP 5.4+. Active exploitation is confirmed. Prepare for emergency patching now! #PHP #RCE #CyberSecurity

🔗 https://cyber.netsecops.io/articles/critical-php2shell-vulnerabilities-leaked-ahead-of-patch/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

https://aws.amazon.com/security/security-bulletins/2026-143-aws/

#aws #security

PHP fixed two remote code execution flaws today, CVE-2026-109618 and
CVE-2026-109619. Anything serving PHP is affected, whatever sits on top of it.

Two steps, and the second is missing from most of the advice going round:

1. Update PHP. 8.5.12, 8.4.27, 8.3.36, 8.2.35, or your distro's backport.
2. Restart PHP. A pool loads its binary once and serves from it until it
restarts, so the fix on disk reaches nothing already running.

PHP 8.1 is past end of life and gets no fix. Move those sites.

@mcc I don't know if this is any help at all, but here's the update statement from my web host.

https://clients.websavers.ca/whmcs/announcements/83/Vulnerability-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619---Mitigations-Applied.html

Patching PHP 7.4 for php2shell in a container

PHP 보안팀이 공개한 CVE-2026-109618(메모리 부족 상태의 손상)과 CVE-2026-109619(stale global state)은 웹 요청을 처리하는 PHP 환경에서 원격 코드 실행으로 이어질 수 있는 치명적 취약점이며, Apache mod_php 조합에서는 공개 PoC도 언급됐다. 글은 지원 종료된 PHP 7.4 공식 Docker 이미지에서 php-src의 최소 백포트 커밋을 적용하고, 기존 configure 옵션으로 PHP를 재빌드하는 Containerfile 절차를 제시한다. Debian 11 EOL에 따라 archive.debian.org로 APT 소스를 전환하고, 확장...

https://joshbowen.net/posts/patching-php-74-for-php2shell/

Your Sites Are Protected Against the PHP2Shell Vulnerabilities

PHP 프로젝트가 CVSS 9.2의 치명적 취약점 CVE-2026-109618·CVE-2026-109619(‘PHP2Shell’) 보안 업데이트를 공개했다. 인증 없이 일반 HTTP 요청만으로 PHP 런타임의 메모리 정리 오류를 악용해 원격 코드 실행(RCE)과 서버 장악으로 이어질 수 있으며, PHP 5.4 이후 버전과 WordPress·Drupal·Joomla의 최신 설치 사례에도 영향을 준다고 설명한다. 자체 운영 환경은 PHP 8.5.12, 8.4.27, 8.3.36 또는 8.2.35 이...

https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/

PHP2Shell (CVE-2026-109618/109619): first exploit requests arrived 5.5 hours before PHP shipped the fix, and the "scanners" carry Mirai-style loaders https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/

@Hiro looks like patches for bookworm are available already as well: https://security-tracker.debian.org/tracker/CVE-2026-109618

RE: https://infosec.exchange/@Spartan_1986/117480764972910966

So, that build date got me thinking. What if Canonical did implement the fix, but they are not reporting all the build digits? I know. That's stupid. But fortunately I can check on that. I've a Pro account and the server is, of course, registered with the Pro binary installed. You can force any CVE update with a the command "sudo pro fix CVE-YYYY-XXXX". So I ran the command for the two CVEs involved with this vuln. Here's what I got:

*******************************
$ sudo pro fix CVE-2026-109618
CVE-2026-109618: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109618

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109618 is resolved.
$ sudo pro fix CVE-2026-109619
CVE-2026-109619: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109619

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109619 is resolved.
*******************************

Damn it Canonical! Digits f-ing matter!!! Why do you have to be so stupid. I frankly don't even know if I can trust this. It should report the correct version with 'php -v' you numbskulls. This is why I got out of system administration in the first place.

Fixes for PHP CVE-2026-109618 and CVE-2026-109619 have either landed or are on their way.

Fixed versions:

- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35

Check https://build.alpinelinux.org for the current status of each builder, and https://pkgs.alpinelinux.org to see what is present in each repository.

https://pkgs.alpinelinux.org/packages?name=php%253F%253F&branch=v3.24 for example shows the current version of PHP on the v3.24 branch.

Rough Timeline of PHP2Shell

PHP의 CVE-2026-109618·CVE-2026-109619로 명명된 PHP2Shell 사태의 유출부터 패치 배포까지의 경과를 정리한 글입니다. 글에 따르면 두 취약점은 인증 없이 원격 코드 실행(RCE)을 허용하는 CVSS 10.0급 문제로, 패치 전에는 Cloudflare WAF 규칙과 서비스 중단 같은 임시 대응이 확산됐습니다. 공식 패치와 Docker 이미지가 PHP 8 계열에 우선 제공됐으며, PHP 7 이하 사용자는 PHP 8로 긴급 업그레이드하거나 서비스를 계속 격리해야 한다는 주장입니다. 다만 타임라인 내 PoC와 완화책의 유효성에 혼선이 있었다고 서술하므로, 운영자는 비공식 대응책에 의존하지 말고 PHP 보안 공지...

https://www.soeren.codes/articles/timeline-php2shell

A PHP2Shell stopgap "fix" until older PHP versions are updated

PHP2Shell(CVE-2026-109618, CVE-2026-109619)은 PHP 5.4 이후 버전의 mod_php·PHP-FPM·CGI 환경에 영향을 주는 CVSS 9.2의 인증 없이 가능한 원격 코드 실행 취약점이다. 패치 전 임시 완화책으로 웹 서버에서 `multipart/form-data` 요청을 차단하고, PHP `memory_limit`을 해제하며 업로드 진행 상태 기능을 비활성화하는 방법을 제안한다. 이 조치는 파일 업로드와 일부 폼을 중단시키고 메모리 고갈 위험을 높이므로 근본 해결책이 아니며, 배포판의 두 CVE 백포트 패치를 설치한 뒤 Apache/PHP-FPM을 재시작...

https://stuff.sigvaldason.com/php2sh.html

Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:

The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

🚨 PHP2Shell affects multiple vulnerabilities (CVE-2026-109618, CVE-2026-109619).

https://secdb.nttzen.cloud/updates/54fddaeb-7ada-4fa6-bd70-8117eff38bc9/php2shell-vulnerability

ℹ️ Additional details, sightings and PoC:

- CVE-2026-109618 - RCE via OOM corruption - https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618
- CVE-2026-109619 - RCE via stale global state - https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619

#InfoSec #PHP2Shell #RCE #CVE2026109618 #CVE2026109619
#NTTDATA #ZENSecDB

【PHP脆弱性php2shell】WordPressも対象、パッチは21:59に公開済み。「23:15から乗っ取り」「15分でAIが攻撃コード？」は本当か、自分のVPSのログで検証（CVE-2026-109618／109619）：秋山大志のそれとりあえず作ってみようか。：オルタナティブ・ブログ: https://blogs.itmedia.co.jp/agile/2026/10/php2shell_cve_2026_109618_panic.html

PHP2Shell is now under active exploitation

https://www.linkedin.com/posts/yesterday-information-leaked-about-two-share-7518682504153796609-1os5/

https://x.com/PrevidianCyber/status/2112936591719068048

https://x.com/OliverSild/status/2112823822411866215

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

https://aws.amazon.com/security/security-bulletins/2026-143-aws/

#aws #security

@mcc I don't know if this is any help at all, but here's the update statement from my web host.

https://clients.websavers.ca/whmcs/announcements/83/Vulnerability-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619---Mitigations-Applied.html

PHP2Shell (CVE-2026-109618/109619): first exploit requests arrived 5.5 hours before PHP shipped the fix, and the "scanners" carry Mirai-style loaders https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/

RE: https://infosec.exchange/@Spartan_1986/117480764972910966

So, that build date got me thinking. What if Canonical did implement the fix, but they are not reporting all the build digits? I know. That's stupid. But fortunately I can check on that. I've a Pro account and the server is, of course, registered with the Pro binary installed. You can force any CVE update with a the command "sudo pro fix CVE-YYYY-XXXX". So I ran the command for the two CVEs involved with this vuln. Here's what I got:

*******************************
$ sudo pro fix CVE-2026-109618
CVE-2026-109618: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109618

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109618 is resolved.
$ sudo pro fix CVE-2026-109619
CVE-2026-109619: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109619

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109619 is resolved.
*******************************

Damn it Canonical! Digits f-ing matter!!! Why do you have to be so stupid. I frankly don't even know if I can trust this. It should report the correct version with 'php -v' you numbskulls. This is why I got out of system administration in the first place.

Fixes for PHP CVE-2026-109618 and CVE-2026-109619 have either landed or are on their way.

Fixed versions:

- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35

Check https://build.alpinelinux.org for the current status of each builder, and https://pkgs.alpinelinux.org to see what is present in each repository.

https://pkgs.alpinelinux.org/packages?name=php%253F%253F&branch=v3.24 for example shows the current version of PHP on the v3.24 branch.

Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:

The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

🚨 PHP2Shell affects multiple vulnerabilities (CVE-2026-109618, CVE-2026-109619).

https://secdb.nttzen.cloud/updates/54fddaeb-7ada-4fa6-bd70-8117eff38bc9/php2shell-vulnerability

ℹ️ Additional details, sightings and PoC:

- CVE-2026-109618 - RCE via OOM corruption - https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618
- CVE-2026-109619 - RCE via stale global state - https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619

#InfoSec #PHP2Shell #RCE #CVE2026109618 #CVE2026109619
#NTTDATA #ZENSecDB

🔒 All LimeSurvey Cloud servers have been patched against the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 released today. No action is needed for our Cloud customers.

Running LimeSurvey yourself? Please update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 as soon as possible.

#LimeSurvey #PHP #Security #php2shell

Well, so far I have not been able to obtain PHP updates for Fedora 42, 43, and 44.

I am using this as a script:

#!/bin/bash

sudo dnf clean all
sudo dnf check-update php
sudo dnf update php\*

sudo dnf update

sudo systemctl restart php-fpm
# If using Apache:
sudo systemctl restart httpd
# If using Nginx:
# sudo systemctl restart nginx

rpm -q --changelog php-cli | grep -E "CVE-2026-109618|CVE-2026-109619"

Since AWS is feeling lackadaisical about all this... Is it believed that putting this in my php-fpm pools is sufficient?

; CVE-2026-109618
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 16M

; CVE-2026-109619
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[max_file_uploads] = 20
php_admin_value[fatal_error_backtraces] = 0

🚨 We just launched a free #PHP2Shell scanner!

PHP shipped the fix for CVE-2026-109618 & CVE-2026-109619, but attackers had a head start. Find out which of your servers still run a vulnerable version. No account required: https://pentest-tools.com/network-vulnerability-scanning/php2shell-scanner

If your target is vulnerable, you get a finding with the CVSS score, severity rating, and remediation guidance, downloadable as a PDF.

Before you call it patched:
🔍 PHP hides in control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
🙈 Servers that hide their PHP version won’t show up in scan results. Check those with php -v on the host
📦 Distro packages may carry the fix without changing the version number. Check your distro’s security advisory first
⛔ On PHP 8.1 or older? Upgrade to a supported branch. Building from source? PHP published minimal backports for 7.4, 8.0, and 8.1

Fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35.

#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking

#php2shell - Für #Serveradmin , die noch ältere Versionen, zumindest eine zeitlang, benötigen, bietet @php Backports für die folgenden #PHP-Versionen an. So kann man eine gepachte Version selbst bauen.

#PHP74 https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619

#PHP80 https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619

#PHP81 https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619

New.

Palo Alto: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products https://security.paloaltonetworks.com/CVE-2026-109618 #infosec #PHP #vulnerability

@mttaggart

Notable PHP Enjoyer Palo Alto has posted their advisory on #PHP2Shell:

https://security.paloaltonetworks.com/CVE-2026-109618

ALL versions of Panorama and PAN-OS are affected. There's a fix coming, but right now I recommend shutting down anything exposed publicly, like VPN portals.

Must-read blog post from the PHP foundation:

> [ In 2024 ] a PHP core developer contracted by the PHP Foundation found the first signs of the [out-of-memory] OOM problem behind CVE-2026-109618.

> the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#php2shell

Major Web Site Security Alert!

PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update immediately.

CISA POST:
"CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. " https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching #Security #CISA #PHP #CVE
#php2shell #SecurityPatch #SecurityAdvisory #Software #Risk #RemoteCodeExecution #RCE #WebSites #Internet #Web #WWW #CyberSecurity #CyberDefence

OK, sorted.

If you previously followed my example and ran #shotshare (https://www.bentasker.co.uk/posts/blog/general/deploying-shotshare-into-kubernetes.html) you're likely to be vulnerable to #php CVEs CVE-2026-109618 and CVE-2026-109619

Upstream looks to be abandoned, so I've forked and reworked the docker image to consume the fix (PR against upstream: https://github.com/mdshack/shotshare/pull/87)

In the meantime, I've pushed to my registries

* codeberg.org/bentasker/shotshare:202610-php-cve-bump
* bentasker12/shotshare:202610-php-cve-bump

Should be drop-in replacements

Claims of the PHP vulns being EITW:

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.

Here is what you need to know:

* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 

* The root is a decades-old design choice in PHP's error handling (described more in our post)

* There was evidence of in-the-wild exploitation pre-disclosure. 

The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application

We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.

What to do right now:

The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.

Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012. 

The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours. 

Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.

Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.

Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com

Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618

We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

#php2shell #php #CVE #eitw

New.

Google: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619 #Google #infosec #vulnerability #PHP

PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, two critical RCE flaws with reported exploitation. Widespread PHP use raises risk of mass compromise and outages, so prioritize patching and hunt for post-exploit activity. #PhpSecurity #RemoteCodeExecution #PatchNow

https://cyberworldops.eu/en/emergency-php-updates-address-two-critical-rce-flaws-amid-exploitation

PHP has released emergency fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical memory safety flaws in the PHP runtime that can allow unauthenticated code execution.

Upgrade now to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

🔗 https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619

What the PHP2Shell rumors got wrong, from inside the PHP security team https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

Palo finally published an advisory:

https://security.paloaltonetworks.com/CVE-2026-109618

No patch but some customers can get detections. Thanks, Palo. Fucking worthless fucks.

Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.

After publication of the vulnerability and patches, Advanced Threat Prevention (ATP) will release standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625), on Oct 21st.

The security risk posed by this issue on PAN-OS is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.

watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.

https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

#eitw #php #php2shell #CVE

"Plusieurs vulnérabilités critiques découvertes dans #PHP : installez immédiatement les mises à jour de sécurité"

"Deux vulnérabilités critiques dans PHP pourraient permettre à un attaquant d'exécuter du code malveillant sur les serveurs concernés sans avoir à s’authentifier. Des mises à jour de sécurité sont désormais disponibles. L'Office fédéral de la cybersécurité (OFCS) recommande de mettre à jour immédiatement les systèmes concernés. Outre les serveurs web, vérifiez également les applications et les appareils qui utilisent PHP comme composant intégré."
👇
https://www.bacs.admin.ch/fr/warnung-php-fr

🔍
👇
https://security-hub.ncsc.admin.ch/#/posts/13083

🇪🇺
👇
https://db.gcve.eu/vuln/CVE-2026-109618

#CyberVeille #PHP2shell

For those running pfSense+ (and possibly pfSense CE), it seems like PHP packages are starting to roll out:

https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619/15

#pfSense

Der Preis für die dümmste Teaser-Einleitung rund um CVE-2026-109618 und CVE-2026-109619 geht ganz klar an die #futurezone ....

»Es sollen die bisher schwerwiegendsten Sicherheitslücken sein, die je durch Künstliche Intelligenz aufgespürt wurden.«
https://futurezone.at/digital-life/php2shell-luecke-openai-google-70-prozent-des-internets/403199916

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the...

🔗️ [Securelist] https://link.is.it/nPWHOU

PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

Comments: https://news.ycombinator.com/item?id=50182987

#HackerNews #PHPFoundation #CVE2026 #SecurityUpdates #OpenSource #PHPSecurity

The path to happiness and posterity runs through PHP. Here is some of the research dealing with that today - so far.

KrebsonSecurity: Widespread PHP Flaw May Cause Many Site Outages Today https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/ @briankrebs

Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core

Cisco: Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ @TalosSecurity

CrowdStrike: Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/

Kaspersky: Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/ @Kaspersky

Sophos: Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 @SophosXOps

Palo Alto: Millions of PHP Instances Exposed - What Organizations Need To Do Right Now https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/

VulnCheck: PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 https://www.vulncheck.com/blog/php2shell-vulnerabilities @vulncheck

Socket: PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline https://socket.dev/blog/php-critical-rce-patches @SocketSecurity

Rapid7: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/ @Rapid7Official #vulnerability #threatresearch #infosec

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

#php #CISA #CVE

🚨 Rapid Response: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), can allow unauthenticated remote code execution across multiple PHP server configurations.

Censys ARC observes:
🔸 2,580,515 Internet-exposed hosts and 54,888,147 web properties running PHP
🔸 1,575,688 hosts reporting PHP versions older than the fixed releases

These figures do not represent confirmed vulnerable systems. Security fixes may be backported without changing reported version strings.

PHP has released security updates and recommends upgrading immediately.

Full advisory and Censys queries: https://censys.com/advisory/cve-2026-109618-cve-2026-109619/

#CensysARC #Cybersecurity #VulnerabilityManagement #PHP #InfoSec

PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.

If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.

Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

Нескучный октябрь.

> В целях снижения риска эксплуатации уязвимостей CVE-2026-109618 и
CVE-2026-109619 мы отключаем директиву session.upload_progress.enabled.
Некоторые функции сайтов, касающиеся индикации загрузки файлов станут недоступны.
> Патч безопасности затронет версии PHP выше 8.1, поэтому, по возможности, обновитесь до
последних версий PHP.
> Для версий ниже исправлений нет.

> Служба технической поддержки компании .masterhost

@Argyle13

Regarding PHP2shell (CVE-2026-109618 and CVE-2026-109619) vulnerability, you obviously need to patch as quickly as possible but Cloudflare has implemented some mitigation's in it's default firewall that might buy you some time. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Hey! Five alarm #infosec fire! Government websites across Europe have been taken offline following the discovery of two critical security vulnerabilities in PHP, a programming language that underpins a massive portion of the internet.

On October 21, 2026, PHP developers announced emergency patches fixing two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, giving hackers the ability to take control of servers.

PHP is pervasive. It serves as the underlying engine for major content management systems like #WordPress, #Drupal and #Joomla.

Cybersecurity teams globally are being urged to immediately isolate any vulnerable, internet-facing PHP servers until official emergency updates (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) can be manually deployed.

Cloudflare has implemented temporary firewall mitigation rules, but experts stress this is only a stopgap measure.

Go patch your #php. Now.

https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/

Auf Grund der schwerwiegenden PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 sind meine Websites aktuell und für mehrere Stunden nicht erreichbar.

PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and...

🔗️ [Bleepingcomputer] https://link.is.it/LMjG6I

Jesus Christ patch your shit now

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-109618/

Jesus Christ patch your shit n...

Jesus Christ patch your shit now

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-109618/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

@RensBloom I am also awaiting the update for Ubuntu. It got applied quickly (https://ubuntu.com/security/CVE-2026-109618#status) but now is the wait till all mirrors are updated I guess. Or manually add a repo which has the update.

PHP fixes two critical PHP RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing remote code execution. Update to 8.5.12 or 8.4.27.

#PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ModPHP #PatchNow #CyberSecurity

https://securityonline.info/php-rce-vulnerabilities-cve-2026-109618-109619/?utm_source=mastodon&utm_medium=jetpack_social

The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

The php2shell fix is out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Two critical bugs (CVSS 9.2), both remote code execution without authentication. mod_php has the highest risk, but PHP-FPM and other SAPIs are affected too. There are source backports for 7.4, 8.0 and 8.1.

Update, then do a full restart, not a reload.

Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

#PHP #InfoSec #CVE

🚨 Critical pre-authentication RCE research published for two PHP core vulnerabilities; CVE-2026-109618 + CVE-2026-109619

PoC: https://github.com/ikow/php2shell-poc

The flaws affect PHP's session.upload_progress handling and can be chained through session-file injection, memory corruption, or deserialization behavior to achieve remote code execution under specific application conditions.

CVSS: 9.2 Critical
Affected: PHP 5.4.0 through 8.5.11
Fixed: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12

The repository includes verification PoCs for session injection, a heap use-after-free, and handler-mismatch deserialization, along with a vulnerable Docker lab and detailed technical analysis.

📣 Announcing the immediate availability of:

- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12

‼️ These address the following critical security issues:

- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
:windows8: Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

Zwei kritische PHP-Lücken (CVE-2026-109618/109619, CVSS 9,2) ermöglichen unter bestimmten Bedingungen die Ausführung von Schadcode auf Webservern.

Dringend patchen! Für PHP 8.4 ist Version 8.4.27 erforderlich. Unter Debian 13 sind die Updates bereits verfügbar:

apt update && apt upgrade

Anschließend PHP-FPM neu starten:

systemctl restart php8.4-fpm

Auch andere Distributionen sollten jetzt aktualisiert werden!

https://www.php.net/archive/2026.php

#PHP #ITSecurity

#php2shell landed:

https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Wheeeeeeeee!

Unser Provider empfiehlt deutlich, die PHP-Seiten per Firewall/deny all komplett offline zu nehmen… bin gespannt, was um 16h00 disclosed wird (scheint ja in Richtung multiform upload handler zu gehen) #PHP #CVE-2026-109618 #CVE-2026-109619

PHP InfoSec

Wise system administrators who have caught wind of this bug have taken measures already

It hasn't been patched yet but you can mitigate exposure of your systems.
Better yet, do what is written on tweakers.net

Quotes:

Make your store read-only or take it offline

If you can afford to take a PHP server offline for a day, do so. PHP core developer Gina Peter Banyard calls that the most sensible option. Several Dutch sites went offline as a precaution on October 21: tech site Tweakers, the House of Representatives (Tweede Kamer), the National Cyber Security Centre (NCSC) and security news site Security.NL.

Stop PHP-FPM and have your web server show a static maintenance page. The maintenance modes built into Magento and WordPress do not help: PHP still parses each request before the application checks for the maintenance flag.

If you cannot go offline, make the store read-only. Have your web server reject every request method other than GET and HEAD, for example in nginx:

if ($request_method !~ ^(GET|HEAD)$) {
return 503;
}

Quote:

Websites overnemen

De twee kritieke kwetsbaarheden in PHP (CVE-2026-109618 en CVE-2026-109619) hebben een score van 9,2 op de CVSS v4.0-schaal, die tot 10 gaat. Dat hoge cijfer is gebaseerd op de ernst van een kwetsbaarheid en op hoe makkelijk aanvallers die kunnen misbruiken. De kwetsbaarheden zouden al sinds versie 5.4.0 in PHP zitten, die in maart 2012 uitkwam. Aanvallers kunnen door de kwetsbaarheden eigen webpagina's publiceren. Daardoor kunnen zij mogelijk malware verspreiden. Daarnaast zou de zogeheten PHP2Shell-exploit het mogelijk maken om eigen code uit te voeren op kwetsbare servers.

Volgens verschillende beveiligingsadviezen kan het helpen om session.upload_progress.enabled uit te schakelen. Een bijbehorende tijdelijke oplossing zou zijn om session.use_strict_mode in te schakelen. Beveiligingsexpert Kevin Beaumont meldt dat de Linux-kernelbeveiligingsmodule AppArmor of SELinux ook bescherming biedt tegen misbruik van deze grote PHP-kwetsbaarheden.

I understand the NL language
Translate this if you don't

Jump to the sources read and work

Sources:

https://jackalsyn.com/posts/php-up-2026.html

https://sansec.io/research/php2shell

https://tweakers.net/

#PHP #bug #serious #infoSEC #programming #upgrade

🚨 If you run PHP (like most of the internet does), this one can’t wait: #PHP2Shell = 2 critical RCE flaws in PHP core leaked before the patch, with live attacks already reported.

Because CVE-2026-109618 & CVE-2026-109619 sit in PHP itself, every app on a vulnerable PHP version is exposed, no matter what runs on top.

That’s why we’re building detection in our Network Scanner + an exploit module in Sniper as you’re reading this. Stay tuned for the launch announcement!

What to do now:

Inventory every PHP install, including control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
Patch as soon as PHP’s release is out, then restart PHP-FPM or your web server
On PHP 8.1 or older? No fix is coming. Upgrade, or take those systems off the internet
Alert on PHP processes spawning shells, interpreters, or download tools

#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking

@thomasfuchs that's spooky. Remote-code execution 😬

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

> From what has been reported, the flaws are in how PHP processes file-upload requests. When a browser sends a form that contains a file, it uses a multipart/form-data request, which is a request body split into separate parts for each field and file. PHP reads and splits that body itself before your application code runs.

Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)
#CVE_2026_109618 #CVE_2026_109619
https://watchtowr.com/intelligence/php-cve-2026-109618-faq/

Critical PHP security vulnerabilities (CVE-2026-109618/-109619)

Our entire team is working on assessing the impact of the disclosed vulnerabilities and preparing to deploy the PHP patch, which is due to be released today at 4 pm.

Due to maintenance work, there may be some service interruptions. We apologise for any inconvenience caused.

Do you run your own systems using PHP? Please carry out the update to the new version as a matter of urgency today.

We will keep you informed.

Kritische PHP-Sicherheitslücken (CVE-2026-109618/-109619)

Unser gesamtes Team arbeitet an der Betroffenheitsanalyse der bekannt gewordenen Schwachstellen und bereitet das Einspielen des PHP-Patches vor, der heute um 16 Uhr erscheinen soll.

Aufgrund der Wartungsarbeiten kann es zu Unterbrechungen kommen. Wir bitten um Ihr Verständnis.

Betreiben Sie eigene Systeme mit PHP? Führen Sie heute dringend das Update auf die neue Version durch.

Wir halten Sie auf dem Laufenden.

@GossiTheDog Additional PoCs and write-ups, supposedly:

https://github.com/0x4148/CVE-2026-109618-php2shell-lab

https://github.com/syhunt/php2shell-protection

https://qideng.substack.com/p/php2shell-dissecting-phps-critical

🔧 Dočasně vypínáme podporu přes FreeScout (helpdesk.oscloud.cz) kvůli kritické chybě v PHP. Znovu ji zapneme po aplikování opravy.

⚠️ Kritická zranitelnost v PHP, co to znamená pro OSCloud

PHP tým oznámil dvě kritické chyby (CVE-2026-109618 a CVE-2026-109619, obě CVSS 9.2). Mohou umožnit spuštění cizího kódu na serveru bez přihlášení. Oprava vychází dnes v 16:00 SEČ/CEST. Podle hlášení bezpečnostních firem už probíhají první útoky.

Kterých služeb se to týká:
• Nextcloud, WordPress, Pixelfed, FreeScout, a další aplikace postavené na PHP
• LAMP weby zákazníků (Apache + PHP), včetně těch, kde zatím běží jen úvodní stránka

Kterých ne:
• Mastodon, Matrix, PeerTube, Gitea (PHP nepoužívají)
• Weby a úložiště na statických souborech (Surfer)

Co děláme:
• FreeScout jsme vypnuli
• Další PHP aplikace a LAMP weby budeme vypínat postupně a vždy o tom budeme informovat zde. Počítejte s tím, že dočasně vypneme i Nextcloud, a to do vydání a nasazení opravy
• Jakmile budou dostupné opravené verze aplikací, nasadíme je co nejdřív
• Před vypnutím a updaty děláme zálohy

Co to znamená pro vás:
• Podpora přes FreeScout je do opravy nedostupná
• Nextcloud, LAMP weby a další PHP služby mohou být dnes nedostupné
• Pokud by se při updatu něco pokazilo, vracíme se ze zálohy maximálně 12 hodin zpět

Opravu nelze řešit pluginy ani updatem WordPressu, musí přijít nové PHP v rámci aktualizace aplikace. Pokud provozujete vlastní PHP web mimo OSCloud, aktualizujte PHP hned, jak vyjde oprava.

Děkujeme za trpělivost. Stav budeme průběžně aktualizovat v tomto vlákně.

#OSCloud #PHP #Bezpečnost

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) https://isc.sans.edu/diary/33440

⚠️PHP2Shell: Kritische PHP-Lücken CVE-2026-109618/109619⚠️

Zwei kritische PHP-Sicherheitslücken („PHP2Shell“) wurden am 20. Oktober vor Ablauf der Sperrfrist öffentlich. Das PHP-Team hat die Patch-Veröffentlichung daraufhin vorgezogen. (16:00MEZ).

Betroffen ist praktisch jede PHP-Website: #WordPress, #WooCommerce, #Drupal, #Joomla, #Magento. Das geleakte Exploit-Tool nennt PHP ab 5.4.0; offizielle Fixes unterstüzen nur PHP 8.2 bis 8.5 .

#php #php2shell #kritischelücke #sicherheit

Milhões de servidores PHP expostos ao risco da falha PHP2Shell. A recente divulgação de detalhes técnicos sobre as vulnerabilidades críticas no PHP (CVE-2026-109618 e CVE-2026-109619) acendeu os alertas no setor. 🚨

🔗 https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell

#apache #dados #equipa #falha #risco 

Die zentralen Websites der Uni Freiburg sind vom Netz genommen worden. #PHP

https://rz.uni-freiburg.de/de/rz/aktuell/stoerungen/2026-10-21-10-39-massnahme-im-zusammenhang-mit-der-kritischen-schwachstelle-php-cve-2026-109618-und-cve-2026-109619

php2shell: Dissecting PHP's Critical Session Upload Progress Vulnerabilities

CVE-2026-109618 & CVE-2026-109619 — From source code audit to three independent RCE chains

🔗️ [Substack] https://link.is.it/lp3FMf

CVE-2026-109618 & CVE-2026-109619: CRITICAL RCE in PHP (>=5.0.0). Patch lands Oct 21; only PHP 8.x supported. Mass exploitation likely post-release. Prepare to patch ASAP. Details: https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c #OffSeq #PHP #vuln #RCE

Another PoC for CVE-2026-109618/109619 PHP session.upload_progress https://github.com/ikow/php2shell-poc

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress

Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.

🔗️ [Huntress] https://link.is.it/Q3tPnD

🚨 Critical Alert from Karen IT
Two critical unauthenticated RCE vulnerabilities in PHP (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) have leaked early.

https://ksrc.karenit.net/blog/security-alert/urgent-php-remote-code-execution-vulnerabilities-(cve-2026-109618-&-cve-2026-109619)

Do not delay.

#PHP #RCE #CVE #CyberSecurity

🚨 تنبيه حرج
ثغرتان حرجتان في PHP تسمحان بتنفيذ أكواد عن بُعد بدون مصادقة (CVE-2026-109618 و CVE-2026-109619، CVSS 9.2) تم تسريبهما مبكراً.
لا تتأخروا.

#PHP #ثغرات #أمن_سيبراني

PHP : deux failles critiques ont fuité avant l’heure, un correctif d’urgence arrive ce 21 octobre ! https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #PHP

#php2shell
Ok, dann werden wir mal unsere Server absichern, bis es entsprechende gepatchte Versionen von PHP gibt
Im Artikel sind entsprechende Maßnahmen gut beschrieben und erklärt, und auch, was nicht funktioniert.

Da ältere Versionen als #PHP82 keine Patches erhalten werden, muss ich diese wohl eben manuell absichern. (ja, ich nutze auch noch ältere Versionen)

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

#devadmin #serveradmin #cve #php #phpsecurity #phppatch #security

>当該脆弱性を悪用できると主張するコードが、既にインターネット上に出回り始めています（2026/10/21 14時 日本時間 追記）。

PHPの重大な脆弱性「php2shell」（CVE-2026...

Upcoming critical PHP security release (CVE-2026-109618 / -109619): https://news-web.php.net/php.announce/509

Discussion: http://news.ycombinator.com/item?id=50172041

Hade tänkt ha en lugn onsdag med höstpromenad, gotta ned sig i programmeringsproblem och galamiddag på kvällen. Och så...

CVE-2026-109618 / -109619!!!

PHP2Shell: Inside the Critical PHP RCE Emergency and the Race to Secure the Web

https://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/

@gunchleoc @GossiTheDog
Thanks, I updated my blog post mentioning heise and https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

I will not link to sources and you don't have to trust me, but there are already exploits out there, one of them will get you a shell on servers running WordPress. So this is a critical update. CVE-2026-109618 and CVE-2026-109619 seem to affect all PHP versions going back to 5.4 and could result in RCE (Remote Code Execution).

#SysAdminLife @homelab

@pulsar Thanks!

TL;DR: Details of two critical holes in PHP leaked before a fix was ready. They’re in how PHP handles file uploads and could let attackers run their own code on your server. Possibly affects PHP 5 through 8. Fixes are due today at 14:00 UTC, and attacks are expected within minutes of release.

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

The bug sits below WordPress or Laravel, so having no upload form doesn’t protect you, and nor do security plugins or maintenance mode.

Until the patch: list every server running PHP, including old staging sites. Switch off PHP’s upload-progress setting, and get your web server to refuse upload-style requests before they reach PHP. That breaks uploads for a few hours, which is the trade-off.

Once the fix lands: update every PHP version on every server, restart PHP and any background workers, and rebuild Docker images. PHP 8.1 and older won’t get a fix, so upgrade or take them offline. On managed hosting, ask your host to confirm.

CVE-2026-114403: PHPOffice PHPPresentation ≤1.2.0 faces CRITICAL insecure deserialization (CVSS 9.2). Remote code execution & DoS possible via crafted uploads. No patch; avoid untrusted inputs. Details: https://radar.offseq.com/threat/cve-2026-114403-deserialization-of-untrusted-data-in-phpoffice-phppresentation-21b2eb9e24a6b900 #OffSeq #CVE2026114403 #PHP #AppSec

CVE-2026-87095: A CRITICAL auth bypass in Acronis Cyber Infrastructure (pre-6.0.1-112/6.1.1-64/6.2.1-71) risks data disclosure & tampering (CVSS 9.1). No patch confirmed. Limit network access & monitor logs. https://radar.offseq.com/threat/cve-2026-87095-cwe-863-in-acronis-acronis-cyber-infrastructure-10e3c7d3d7e8e2e5 #OffSeq #CVE #Acronis #Vuln #BlueTeam

🚨 Security update: Unbound 1.26.2 is now available.

This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.

https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495

#DNS #OpenSource #Security #CVE

🚨 Security update: Unbound 1.26.2 is now available.

This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.

https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495

#DNS #OpenSource #Security #CVE

🚨 Security update: Unbound 1.26.2 is now available.

This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.

https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495

#DNS #OpenSource #Security #CVE

🚨 Security update: Unbound 1.26.2 is now available.

This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.

https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495

#DNS #OpenSource #Security #CVE

🚨 Security update: Unbound 1.26.2 is now available.

This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.

https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495

#DNS #OpenSource #Security #CVE

🏆 New Achievement! Plex2Shell Shocked!

We gather here today to mourn Plex Media Server, which served your terrible taste in movies faithfully until three vulnerabilities — CVE-2026-96652, CVE-2026-96651, and CVE-2026-96656 — formed the Plex2Shell chain and took it down. Researcher Zach Main disclosed these flaws on July 27th. A patch shipped August 3rd. (1/3)

🏆 New Achievement! Plex2Shell Shocked!

We gather here today to mourn Plex Media Server, which served your terrible taste in movies faithfully until three vulnerabilities — CVE-2026-96652, CVE-2026-96651, and CVE-2026-96656 — formed the Plex2Shell chain and took it down. Researcher Zach Main disclosed these flaws on July 27th. A patch shipped August 3rd. (1/3)

New advisory from Fortinet for a medium-severity bug:

CVE-2025-66178: FortiWeb improper neutralization of special elements used in an OS command vulnerability https://app.opencve.io/cve/CVE-2025-66178

Yesterday:

CRITICAL: CVE-2026-106173: improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 https://app.opencve.io/cve/CVE-2026-106173 #Fortinet #infosec #vulnerability

🏆 New Achievement! gRPC Reaper Has Entered the Room!

A shadow falls across your server rack. The torches flicker. The orchestral stabs begin. Ladies and gentlemen — CVE-2026-106173 has arrived. Fortinet's FortiSIEM harbors a critical path traversal flaw in its gRPC service, and this boss doesn't knock: unauthenticated attackers can overwrite system scripts and achieve full remote code execution. No credentials required. (1/3)

Critical FortiSIEM gRPC Flaw Allows Unauthenticated Remote Code Execution

Fortinet patched a critical path traversal vulnerability (CVE-2026-106173) in FortiSIEM that allows unauthenticated attackers to achieve remote code execution by overwriting system scripts via a gRPC service.

**If you run FortiSIEM on-premise (versions 7.0 through 7.5.0), upgrade to 7.5.1 or later right away. A working exploit is already public, so treat this as an emergency. Until you can patch, block TCP port 27918 for everything except trusted management networks, and check whether `/opt/charting/redishb.sh` or `/opt/phoenix/bin/phLicenseTool` has been modified.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-fortisiem-grpc-flaw-allows-unauthenticated-remote-code-execution-b-w-l-1-m/gD2P6Ple2L

#Signal bug could keep your mic - and camera - on after hangup
The #vulnerability, CVE-2026-113380, was published by MITRE on Tuesday and given a CVSS score of 9.3, marking it as a critical issue in Signal’s open-source #RingRTC library in every single version before 2.72.0. That update was pushed out last month, but the vulnerability wasn’t made public until now.
Careful what you say after goodbye, or better yet, update your messaging app.
https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528

Signal fixed critical RingRTC flaw CVE-2026-113380, which could leave audio—and possibly video—active after hangup. The fix is in RingRTC 2.72.0; Signal users should update their apps. 🔒📞 #Signal #Cybersecurity https://cyberinsider.com/signal-fixes-critical-flaw-that-could-keep-audio-active-after-hangup/

KeePassXC 2.8 fixes five security issues affecting versions 2.7.x and earlier.

The fixes cover memory handling when importing legacy KDB databases, two browser-integration issues, and a Windows issue involving SSH key sharing with Pageant.

One issue is tracked as CVE-2026-69150; the other four did not yet have CVE IDs.

The developers rated all five low to medium severity, say none puts encryption or core password-manage…

https://en.hacks.gr/to-keepassxc-2-8-kykloforise-me-pente-diorthoseis-asfaleias/

#KeePassXC #CVE202669150 #Qt6 #PasswordManager

🚨 Critical GitLab flaw allows unauthenticated attackers to execute code on servers

GitLab has patched CVE-2026-97229, a maximum-severity vulnerability affecting Community Edition and Enterprise Edition.
⠀
The integer overflow flaw exists in GitLab’s CI/CD regular expression compiler. Under certain conditions, an attacker can execute arbitrary code on a GitLab server by placing a specially crafted regular expression in a CI/CD configuration.

No authentication or user interaction is required.
⠀
Key details:

• CVSS score: 10.0
• Network-accessible
• No privileges required
• Affects GitLab 19.2 before 19.2.8
• Affects GitLab 19.3 before 19.3.5
• Affects GitLab 19.4 before 19.4.2
⠀
GitLab.com and GitLab Dedicated environments have already been patched. Administrators running self-managed installations should update immediately.

Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

🚨 Critical GitLab flaw allows unauthenticated attackers to execute code on servers

GitLab has patched CVE-2026-97229, a maximum-severity vulnerability affecting Community Edition and Enterprise Edition.
⠀
The integer overflow flaw exists in GitLab’s CI/CD regular expression compiler. Under certain conditions, an attacker can execute arbitrary code on a GitLab server by placing a specially crafted regular expression in a CI/CD configuration.

No authentication or user interaction is required.
⠀
Key details:

• CVSS score: 10.0
• Network-accessible
• No privileges required
• Affects GitLab 19.2 before 19.2.8
• Affects GitLab 19.3 before 19.3.5
• Affects GitLab 19.4 before 19.4.2
⠀
GitLab.com and GitLab Dedicated environments have already been patched. Administrators running self-managed installations should update immediately.

Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell

Bulletin ID: 2026-132-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/09/2026 08:30 AM PDT
Description:
AWS Tools for PowerShell V5 lets developers and administrators manage their AWS services fr...

https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/

#aws #security

CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell

Bulletin ID: 2026-132-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/09/2026 08:30 AM PDT
Description:
AWS Tools for PowerShell V5 lets developers and administrators manage their AWS services fr...

https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/

#aws #security

🏆 New Achievement! Plex2Shell Shocked!

We gather here today to mourn Plex Media Server, which served your terrible taste in movies faithfully until three vulnerabilities — CVE-2026-96652, CVE-2026-96651, and CVE-2026-96656 — formed the Plex2Shell chain and took it down. Researcher Zach Main disclosed these flaws on July 27th. A patch shipped August 3rd. (1/3)

CVE-2026-94213 Keycloak authorization bypass (CVSS 4.9): a delegated admin can read full profiles and roles of any user in the realm. No patch confirmed yet, so restrict delegated admin roles and monitor until a fix lands. #CVE #infosec #Keycloak https://www.valtersit.com/cve/CVE-2026-94213/

Plex Media Server is being widely exploited: a four-bug chain gives remote code execution on servers older than 1.43.3.10861. CISA added it to KEV Oct 20. Update now and check the Codecs folder.

Also: PAN-OS GlobalProtect CVE-2026-0257 (ransomware, patch now), and EOL D-Link NAS and UniFi Video boxes hijacked for bandwidth. Retire them.

Free Wednesday email:
https://patchorpass.beehiiv.com/?utm_source=mastodon&utm_medium=social&utm_campaign=issue1

#infosec #homelab #selfhosted #plex

CVE-2026-0257 affects PAN-OS GlobalProtect portals and gateways, potentially allowing attackers to bypass security restrictions and establish an unauthorized VPN connection. https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226

CVE-2025-54068 : Deep Dive Into Livewire, From Weak Typing To Pre-Authenticated Remote Command Execution - Rémi Matasse
#HackLu @hack_lu
https://youtu.be/zPW_lNbYy1M

New advisory from Fortinet for a medium-severity bug:

CVE-2025-66178: FortiWeb improper neutralization of special elements used in an OS command vulnerability https://app.opencve.io/cve/CVE-2025-66178

Yesterday:

CRITICAL: CVE-2026-106173: improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 https://app.opencve.io/cve/CVE-2026-106173 #Fortinet #infosec #vulnerability

What the PHP2Shell rumors got wrong, from inside the PHP security team https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

NOT NOW, GITLAB AND NODEJS.

CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler => RCE
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee

CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits RCE
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Apply the GitLab critical patch release to fix 12 GitLab vulnerabilities, including 10.0 CVSS RCE flaw CVE-2026-110264 and CVE-2026-15723.

#GitLab #CVE2026110264 #DevSecOps #RCE #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/gitlab-critical-patch-release-cve-2026-110264/?utm_source=mastodon&utm_medium=jetpack_social

@ifin Did you also catch the CVSS 10.0 from GitLab? https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee

Oh. My. Bob. It is a hella day to be in #infosec, I tell you what.

#Gitlab has a CVSS 10! and released critical patch updates on October 21, 2026, addressing multiple severe vulnerabilities including an unauthenticated Remote Code Execution (#RCE) flaw.

The patches cover GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.

The update fixes CVE-2026-110264, a CVSS 10.0 integer overflow in the regular expression compiler that allows unauthenticated code execution across all self-managed versions dating back to 7.0 (2014).

The release also remediated 10 additional security issues, including cache poisoning in OAuth/OIDC endpoints (told you it was problematic).

Administrators of self-managed GitLab instances are strongly advised to upgrade immediately, as GitLab.com and GitLab Dedicated tenants already have the fixes applied.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

@ivy@social.estrogen.it gitlab CVE-2026-110264,,

NOT NOW, GITLAB AND NODEJS.

CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler => RCE
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee

CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits RCE
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Apply the GitLab critical patch release to fix 12 GitLab vulnerabilities, including 10.0 CVSS RCE flaw CVE-2026-110264 and CVE-2026-15723.

#GitLab #CVE2026110264 #DevSecOps #RCE #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/gitlab-critical-patch-release-cve-2026-110264/?utm_source=mastodon&utm_medium=jetpack_social

@ifin Did you also catch the CVSS 10.0 from GitLab? https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee

Oh. My. Bob. It is a hella day to be in #infosec, I tell you what.

#Gitlab has a CVSS 10! and released critical patch updates on October 21, 2026, addressing multiple severe vulnerabilities including an unauthenticated Remote Code Execution (#RCE) flaw.

The patches cover GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.

The update fixes CVE-2026-110264, a CVSS 10.0 integer overflow in the regular expression compiler that allows unauthenticated code execution across all self-managed versions dating back to 7.0 (2014).

The release also remediated 10 additional security issues, including cache poisoning in OAuth/OIDC endpoints (told you it was problematic).

Administrators of self-managed GitLab instances are strongly advised to upgrade immediately, as GitLab.com and GitLab Dedicated tenants already have the fixes applied.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

NOT NOW, GITLAB AND NODEJS.

CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler => RCE
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee

CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits RCE
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

CVE-2026-111497 reporting in from node.js!

NOT NOW, GITLAB AND NODEJS.

CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler => RCE
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee

CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits RCE
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

@Viss sorry direct link to the RCE CVE

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-111497/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-111497/

"No way to prevent this" say u...

The Node.js security release fixes 10 flaws, including a Brotli remote code execution bug, CVE-2026-111497. Update to 26.12.1, 24.22.1 or 22.23.4.

#NodeJS #CVE2026111497 #CVE2026105483 #CVE2026106069 #RemoteCodeExecution #TLS #JavaScript #CyberSecurity

https://securityonline.info/nodejs-security-release-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Node.js Brotli decoder out-of-bounds write permits remote code execution

(CVE-2026-111497) - (high)

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high

Why nobody is freaking out about this one?

Apply the GitLab critical patch release to fix 12 GitLab vulnerabilities, including 10.0 CVSS RCE flaw CVE-2026-110264 and CVE-2026-15723.

#GitLab #CVE2026110264 #DevSecOps #RCE #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/gitlab-critical-patch-release-cve-2026-110264/?utm_source=mastodon&utm_medium=jetpack_social

Apply the GitLab critical patch release to fix 12 GitLab vulnerabilities, including 10.0 CVSS RCE flaw CVE-2026-110264 and CVE-2026-15723.

#GitLab #CVE2026110264 #DevSecOps #RCE #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/gitlab-critical-patch-release-cve-2026-110264/?utm_source=mastodon&utm_medium=jetpack_social

@gsuberland Does CVE-2026-99999 from a few days ago count?

@gsuberland Does CVE-2026-99999 from a few days ago count?

Too many pessimists among our system administrators and software engineers regarding CVE-2026-99999.

Look on the bright side! At least you know it's the last CVE of the year, and you can relax.

#CVE #PHP #four #TLS #CVE202699999 #sarcasm #sysadmin #ReplyGuy #DontReplyGuyMe

@douglasvb @fname Don't lose track of CVE-2026-99999 either 🫠

🚨 PwnEscape (CVE-2026-99999), a critical Linux kernel flaw, could let malicious VMs escape KVM isolation and compromise hosts. Admins should patch and plan for a reboot; researchers warn exploits may emerge within weeks. 🔒 #Linux #Cybersecurity https://www.heise.de/en/news/PwnEscape-Critical-Linux-kernel-flaw-allows-VM-escape-11492399.html

@gettie my cybersecurity tool of choice is running fucking Solaris. CVE-2026-99999 doesn't do shit on Solaris lol

@mcc CVE-2026-99999 is also known as PwnEscape, a very real vuln that enables KVM guest to host escape. https://heise.de/-11492399
I wonder if MITRE is going to sell vanity CVEs at some point in the future.

CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bounds heap writes https://lobste.rs/s/dldfel #c #security
https://www.openwall.com/lists/oss-security/2026/10/21/18

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-107891/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-107891/

"No way to prevent this" say u...

As an issue that can lead to writes outside of an allocated object, overflowing into other objects on the heap, CVE-2026-107891 should be taken with appropriate seriousness.

However, as far as we know at this time, without concurrent accesses from another thread to objects which might be stomped during regcomp, or unsafe SIGSEGV handler code, a predictable crash should happen before any further code runs that could use the clobbered objects in a way yielding control over the flow of execution to an attacker.

SECURITY ADVISORY: musl libc up through 1.2.6 (present version) is affected by integer overflows in regcomp (regular expression handling) leading to insufficient allocation of heap-based buffers for the compiled regex data structures.

CVE-2026-107891 has been assigned for this issue.

https://www.openwall.com/lists/musl/2026/10/21/1

🚨 JUST IN: Announcing rustup 1.29.2

> Rustup 1.29.2 is a small security release that updates dependencies to fix the eMudhra intermediate certificate issue (CVE-2026-111943). Update with rustup self update.

@q3k and also

> TLS certificate hostname bypass when the host loosely resolves to an IP address (CVE-2026-106069) - (high)

???

2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS

This is a security release. Notable Changes (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High (CVE-2026-105483)...

https://github.com/nodejs/node/releases/tag/v26.12.1

#nodejs #javascript

2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95

This is a security release. Notable Changes (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) (CVE-2026-106069) tls: reject non-canonical...

https://github.com/nodejs/node/releases/tag/v22.23.4

#nodejs #javascript

> TLS certificate hostname bypass when the IP is written fullwidth digits (CVE-2026-105483) - (high)

what a week

2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS

This is a security release. Notable Changes (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High (CVE-2026-105483)...

https://github.com/nodejs/node/releases/tag/v26.12.1

#nodejs #javascript

2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95

This is a security release. Notable Changes (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) (CVE-2026-105483) tls: fix ip normalization...

https://github.com/nodejs/node/releases/tag/v24.22.1

#nodejs #javascript

2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS

This is a security release. Notable Changes (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High (CVE-2026-105483)...

https://github.com/nodejs/node/releases/tag/v26.12.1

#nodejs #javascript

2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95

This is a security release. Notable Changes (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) (CVE-2026-105483) tls: fix ip normalization...

https://github.com/nodejs/node/releases/tag/v24.22.1

#nodejs #javascript

2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95

This is a security release. Notable Changes (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) (CVE-2026-106069) tls: reject non-canonical...

https://github.com/nodejs/node/releases/tag/v22.23.4

#nodejs #javascript

2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS

This is a security release. Notable Changes (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High (CVE-2026-105483)...

https://github.com/nodejs/node/releases/tag/v26.12.1

#nodejs #javascript

2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95

This is a security release. Notable Changes (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) (CVE-2026-105483) tls: fix ip normalization...

https://github.com/nodejs/node/releases/tag/v24.22.1

#nodejs #javascript

2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95

This is a security release. Notable Changes (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) (CVE-2026-106069) tls: reject non-canonical...

https://github.com/nodejs/node/releases/tag/v22.23.4

#nodejs #javascript