Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

New.

Palo Alto: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products https://security.paloaltonetworks.com/CVE-2026-109618 #infosec #PHP #vulnerability

@mttaggart

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #programmingAtKukei https://masto.kukei.eu/browse/programming category:
Here are the key topics dominating the discussion in these Mastodon posts:

1. **Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619)**
- Widespread concern over two severe RCE flaws in PHP (CVSS 9.2) affecting versions from PHP 5 onward. Patches released on October 21, 2026, with urgent calls to update or disable PHP services. [1/4]

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #technologyAtKukei https://masto.kukei.eu/browse/technology category:
- **Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)**
- Two critical remote code execution flaws in PHP affecting versions from PHP 5 onward. Patches released on October 21, 2026, with widespread impact on web servers globally.

- **eMudhra CA private key compromise**
- Eight intermediate CA certificates compromised, with [1/3]

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #newsAtKukei https://masto.kukei.eu/browse/news category:
- **Critical PHP vulnerabilities (PHP2Shell)**: Two severe flaws in PHP (CVE-2026-109618, CVE-2026-109619) led to widespread website outages, with admins urged to patch immediately.
- **Galaxy S27 leaks**: Samsung may reduce memory and raise prices for the upcoming Galaxy S27 series.
- **AfD data leaks**: Hackers exposed internal AfD [1/3]

PHP's CVSS 9.2 fixes: Memory exhaustion and stale request state

PHP가 CVSS v4 9.2로 평가된 두 메모리 안전성 취약점(CVE-2026-109618, CVE-2026-109619)을 긴급 패치했다. 첫 번째는 메모리 부족(OOM) 발생 시 `zend_bailout()`이 정리 절차를 건너뛰어 미완성 내부 객체가 사용될 수 있는 문제로, 조작된 업로드 요청을 통해 Apache mod_php에서 인증 없이 원격 코드 실행(RCE)으로 이어질 수 있다. 두 번째는 재사용되는 워커가 이전 요청의 해제된 세션·백트레이스 관련 상태를 다음 요청에서 참조할 수 있는 stale request state 문제이며, mod_php와 PHP-FPM에서...

https://jdstaerk.substack.com/p/php-emergency-fix

PHP2Shell Explained: PHP2Shell Was in the Training Data

글은 PHP 코어의 CVE-2026-109618·CVE-2026-109619(통칭 PHP2Shell)가 요청 처리 중 메모리 부족(OOM)과 C의 longjmp 기반 예외 탈출을 악용해 메모리 노출 및 원격 코드 실행으로 이어질 수 있다고 설명합니다. 핵심 원인은 multipart/form-data 파서에서 제한을 우회해 정밀하게 OOM을 유발하고, 그 과정에서 초기화되지 않은 엔트리나 요청 종료 후 남은 전역 dangling pointer를 남기는 것입니다. 영향을 받을 수 있는 공개 PHP 배포 환경은 PHP 8.5.12, 8.4.27, 8.3.36, 8...

https://deadneurons.substack.com/p/php2shell-explained-php2shell-was

What the PHP2Shell rumors got wrong, from inside the PHP security team

PHP 보안팀 관점에서 PHP2Shell 루머와 실제 취약점(CVE-2026-109618, CVE-2026-109619)을 대조하며, 핵심 RCE는 기본 설정의 Apache mod_php에서 애플리케이션 코드 실행 전 원격으로 트리거될 수 있다고 설명합니다. 주된 원인은 memory_limit 초과 시 Zend allocator가 longjmp로 요청 초기화 중인 C 코드의 실행을 중단하고, 미완성 상태의 요청 구조체가 shutdown 단계에서 사용되며 발생하는 메모리 손상입니다. 패치된 PHP 8.2.35·8.3.36·8.4.27·8.5.12는 a...

https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

Cloudflare deploys protections against php2shell vulnerability

PHP 5.4 이상 런타임에 영향을 주는 php2shell(CVE-2026-109618, CVE-2026-109619)은 비정상적인 HTTP 요청 처리 중 메모리 초기화·해제 오류를 악용해 서비스 거부, 민감 정보 노출, 원격 코드 실행으로 이어질 수 있는 중대 취약점이다. WordPress와 Magento를 포함해 광범위한 PHP 기반 서비스가 영향을 받을 수 있으며, 공개 전 유출된 뒤 실제 공격 트래픽과 WAF 우회용 페이로드 변형도 관측됐다. Cloudflare는 모든 WAF 플랜에 관리형 탐지를 기본 배포했으며, 요청뿐 아니라 원본 응답까지 같은...

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Patch the Planet

OpenAI의 Daybreak 이니셔티브가 Trail of Bits, Calif, HackerOne과 협력해 오픈소스 보안 취약점을 검증·패치·책임 공개하는 프로그램인 ‘Patch the Planet’을 공개했다. 첫 공개 사례인 php2shell은 CVE-2026-109618 및 CVE-2026-109619로 추적되는 PHP의 치명적 취약점으로, 영향받는 서버에서 인증되지 않은 공격자가 원격 코드 실행을 할 수 있다고 설명한다. 유지보수자가 릴리스 통제권을 유지하는 방식으로 패치와 공개를 지원하며, 장기적으로 테스트·퍼징·보안 워크플로도 제공한다. PHP 운영 환경 및 이를 의존하는 AI 서비스는 해당 CVE의 영향 버전과 배포된 패치를 즉시 확인할 필요가 있다.

https://patchtheplanet.org/

#php #security #rce #opensource #vulnerability

Unauthenticated RCE in PHP via stale global state

PHP 엔진의 OOM 처리와 요청 간 전역 상태 정리 결함을 악용하면, 지속 워커를 사용하는 Apache mod_php 및 일부 PHP-FPM 환경에서 인증 없이 원격 코드 실행(RCE)이 가능하다는 보안 분석이다. CVE-2026-109618은 `memory_limit` 초과 시 `longjmp()` 기반 bailout이 반쯤 초기화된 요청 상태를 남기는 문제이고, CVE-2026-109619는 이전 요청 힙을 가리키는 전역 상태가 다음 요청에서 사용되는 use-after-free 문제다. 멀티파트 요청, 세션 업로드 진행률, 요청 초기화 전 적용되는 INI 설정 진단 등이 공격 경로가 될 수 있으며, mod_php에서 HTTP 기반...

https://markdown.page/AzvY2d69

🚨 PHP 8.5.12 may STILL be vulnerable to PHP2Shell.

The release was supposed to patch CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities rated CVSS 9.2.

But if reports of a remaining attack path are confirmed, even upgrading to PHP 8.5.12 may not be enough.

⚠️ Don't assume you're safe just because your version number matches the patched release. Verify the latest PHP security advisories before declaring your servers protected.

Full technical breakdown 👇
https://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/

#PHP #InfoSec #RCE

Major Web Site Security Alert!

PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update immediately.

CISA POST:
"CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. " https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching #Security #CISA #PHP #CVE
#php2shell #SecurityPatch #SecurityAdvisory #Software #Risk #RemoteCodeExecution #RCE #WebSites #Internet #Web #WWW #CyberSecurity #CyberDefence

OK, sorted.

If you previously followed my example and ran #shotshare (https://www.bentasker.co.uk/posts/blog/general/deploying-shotshare-into-kubernetes.html) you're likely to be vulnerable to #php CVEs CVE-2026-109618 and CVE-2026-109619

Upstream looks to be abandoned, so I've forked and reworked the docker image to consume the fix (PR against upstream: https://github.com/mdshack/shotshare/pull/87)

In the meantime, I've pushed to my registries

* codeberg.org/bentasker/shotshare:202610-php-cve-bump
* bentasker12/shotshare:202610-php-cve-bump

Should be drop-in replacements

Claims of the PHP vulns being EITW:

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.

Here is what you need to know:

* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 

* The root is a decades-old design choice in PHP's error handling (described more in our post)

* There was evidence of in-the-wild exploitation pre-disclosure. 

The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application

We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.

What to do right now:

The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.

Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012. 

The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours. 

Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.

Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.

Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com

Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618

Kritisches PHP-Sicherheitsproblem: Websites offline

Sogar das BSI hat schon eine dringende Warnung veröffentlicht. Etwas hilfreicher ist der Text von Brian Krebs. Die besten und vor allem aktuellen Informationen gibt es beim SANS-ISC.
Beim jetzigen Kenntnisstand stellt sich die Lage so dar: In der FOSS Programmiersprache PHP wurden zwei Sicherheitslücken gefunden, die jetzt die Nummern CVE-2026-109618 und CVE-2026-109619 erhalten haben. Die zugrunde liegenden Schwachstellen existieren schon seit der Steinzeit, aber bisher war ihre eventuelle Ausnutzung so kompliziert, dass sie keine Gefahr darstellten. Mit Auftreten der KI hat sich das geändert. ... Weiterlesen:

https://www.pc-fluesterer.info/wordpress/2026/10/21/kritisches-php-sicherheitsproblem-websites-offline/

#0day #cms #exploits #KI #provider #sicherheit #vorbeugen #wissen

📢 PHP2Shell : deux vulnérabilités RCE critiques CVE-2026-109618 et CVE-2026-109619 patchées en urgence

L'article couvre la fuite prématurée de deux vulnérabilités critiques PHP et la réponse d'urgence de l'équipe PHP. Le 20 octobre 2026, un post sur Hacker News a révélé l'existence de deux vulnérabilités critiques PHP (CVE-2026-109618 et CVE-2026-109619) avant leur…

📖 cyberveille : https://cyberveille.ch/posts/2026-10-21-php2shell-deux-vulnerabilites-rce-critiques-cve-2026-109618-et-cve-2026-109619-patchees-en-urgence/
🌐 source : https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
🟢 vérification factuelle haute
#PHP #RCE #Cyberveille

We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

#php2shell #php #CVE #eitw

New.

Google: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619 #Google #infosec #vulnerability #PHP

PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, two critical RCE flaws with reported exploitation. Widespread PHP use raises risk of mass compromise and outages, so prioritize patching and hunt for post-exploit activity. #PhpSecurity #RemoteCodeExecution #PatchNow

https://cyberworldops.eu/en/emergency-php-updates-address-two-critical-rce-flaws-amid-exploitation

PHP2Shell

PHP 코어의 메모리 안전성 취약점군 ‘PHP2Shell’(CVE-2026-109618, CVE-2026-109619)이 공개됐으며, CVSS 9.2로 인증 없이 PHP 워커에서 원격 코드 실행(RCE) 또는 프로세스 메모리 유출을 일으킬 수 있습니다. 공격은 WordPress·Drupal·Joomla에 국한되지 않으며, 취약한 PHP 런타임 위의 단순 애플리케이션도 영향을 받을 수 있고 메모리에서 API 키·토큰·비밀번호·인증서가 노출될 수 있습니다. PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 이상으로 모든 런타임을 업데이트한 뒤 Apache, PHP-FPM 및 장기 실행 워커를 재시작해야 합니다. 즉시 패치가 불가하면 메모리·입력 크기·워커 재사용을 제한하는 완화책을 검토할 수 있지만, 이는...

https://www.php2shell.com

A tale of two PHP remote vulnerabilities

PHP 5.4.0 이상에 영향을 주는 CVE-2026-109618 및 CVE-2026-109619는 `memory_limit` 초과로 발생한 fatal error가 네이티브 코드의 정리 절차를 중단시키면서, 요청 종료 시 stale 상태를 해제하도록 만들어 원격 코드 실행(RCE)으로 이어질 수 있는 취약점이다. 연구진은 chunked/HTTP2 multipart 요청 또는 중첩된 빈 파일 업로드를 이용해 기본 `post_max_size` 제약 아래에서도 메모리 고갈을 유도하고, 부분 초기화된 HashTable bucket을 teardown이 소비하게 만드는 경로를 제시했다. 기본 구성에서 Apache mod_php 및 일부 PHP-FPM 경로에 신뢰성...

https://calif.io/php2shell.x/

PHP has released emergency fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical memory safety flaws in the PHP runtime that can allow unauthenticated code execution.

Upgrade now to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

🔗 https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619

PHP 8.2.35

PHP 8.2.35는 인증 없이 원격 코드 실행이 가능한 치명적 취약점 2건(CVE-2026-109618, CVE-2026-109619)을 수정한 보안 릴리스다. 완전한 완화책이 없으며, PHP 8.2을 운영하는 서비스는 즉시 해당 버전 또는 지원되는 최신 PHP 버전으로 업데이트해야 한다. PHP 기반 AI 서비스의 API 서버, 작업 큐 워커, 플러그인·CMS 연동 백엔드도 공격 표면이 될 수 있으므로 이미지 태그, CI 의존성, 런타임 배포 버전을 함께 점검해야 한다. PHP 8.2의 지원은 2026년 12월 31일 종료되므로 장기적으로는 지원 버전으로의 업그레이드 계획이 필요하다.

https://github.com/php/php-src/releases/tag/php-8.2.35

#php #security #rce #cve #supplychain

PHP Vulnerabilities Expose Millions to Remote Code Execution Risk

Millions are at risk of remote code execution due to critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting versions from 5.4.0 across PHP series 5, 6, 7, and 8. Patches were swiftly released on October 21, 2026, to mitigate these highly severe flaws.

https://osintsights.com/php-vulnerabilities-expose-millions-to-remote-code-execution-risk?utm_source=mastodon&utm_medium=social

#RemoteCodeExecution #PhpVulnerabilities #Cve2026109618 #Cve2026109619 #EmergingThreats

PHP Vulnerabilities Spark Widespread Exploitation Fears

A critical alert has been issued for PHP users, with nearly 70% of websites needing to update their core software to patch two severe vulnerabilities that could give attackers full control over affected servers. These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are already being exploited, causing outages and…

https://osintsights.com/php-vulnerabilities-spark-widespread-exploitation-fears?utm_source=mastodon&utm_medium=social

#PhpVulnerabilities #Cve2026109618 #Cve2026109619 #WebApplicationSecurity #EmergingThreats

watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.

https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

#eitw #php #php2shell #CVE

For those running pfSense+ (and possibly pfSense CE), it seems like PHP packages are starting to roll out:

https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619/15

#pfSense

Der Preis für die dümmste Teaser-Einleitung rund um CVE-2026-109618 und CVE-2026-109619 geht ganz klar an die #futurezone ....

»Es sollen die bisher schwerwiegendsten Sicherheitslücken sein, die je durch Künstliche Intelligenz aufgespürt wurden.«
https://futurezone.at/digital-life/php2shell-luecke-openai-google-70-prozent-des-internets/403199916

Google Cloud response to core PHP vulnerabilities
https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619
#googlecloud #php

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the...

🔗️ [Securelist] https://link.is.it/nPWHOU

PHP Disrupts Code Execution Flaws with Emergency Patches

PHP has urgently released patches for two critical code execution flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 in severity, that can put nearly every PHP installation at risk. Updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 is crucial to protect your server from these vulnerabilities.

https://osintsights.com/php-disrupts-code-execution-flaws-with-emergency-patches?utm_source=mastodon&utm_medium=social

#Php #CodeExecution #Cve2026109618 #Cve2026109619 #RemoteCodeExecution

PHP Developers Rush to Patch Critical Vulnerabilities

PHP developers, beware: two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been discovered, allowing unauthenticated remote code execution, and emergency patches have been released to fix the issue. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 ASAP to protect your applications from potential…

https://osintsights.com/php-developers-rush-to-patch-critical-vulnerabilities?utm_source=mastodon&utm_medium=social

#PhpVulnerabilities #RemoteCodeExecution #Cve2026109618 #Cve2026109619 #WebApplicationSecurity

PHP has released emergency updates for two severe runtime vulnerabilities named PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2.

The flaws affect nearly all PHP versions back to PHP 5.4.

Researchers noted that AI assisted in turning old primitives into working exploits, while Cloudflare observed early attack attempts before patches shipped.

Fixes are included in versions 8.5.12, 8.4.27, 8.3.36…

https://en.hacks.gr/epeigoyses-enimeroseis-asfaleias-gia-tin-php-logo-sovaron-kenon/

#PHP #PHP2Shell #CVE2026109618 #WebDev

PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619 - https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#hackernews

PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

Comments: https://news.ycombinator.com/item?id=50182987

#HackerNews #PHPFoundation #CVE2026 #SecurityUpdates #OpenSource #PHPSecurity

The path to happiness and posterity runs through PHP. Here is some of the research dealing with that today - so far.

KrebsonSecurity: Widespread PHP Flaw May Cause Many Site Outages Today https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/ @briankrebs

Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core

Cisco: Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ @TalosSecurity

CrowdStrike: Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/

Kaspersky: Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/ @Kaspersky

Sophos: Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 @SophosXOps

Palo Alto: Millions of PHP Instances Exposed - What Organizations Need To Do Right Now https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/

VulnCheck: PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 https://www.vulncheck.com/blog/php2shell-vulnerabilities @vulncheck

Socket: PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline https://socket.dev/blog/php-critical-rce-patches @SocketSecurity

Rapid7: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/ @Rapid7Official #vulnerability #threatresearch #infosec

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

#php #CISA #CVE

🚨 Rapid Response: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), can allow unauthenticated remote code execution across multiple PHP server configurations.

Censys ARC observes:
🔸 2,580,515 Internet-exposed hosts and 54,888,147 web properties running PHP
🔸 1,575,688 hosts reporting PHP versions older than the fixed releases

These figures do not represent confirmed vulnerable systems. Security fixes may be backported without changing reported version strings.

PHP has released security updates and recommends upgrading immediately.

Full advisory and Censys queries: https://censys.com/advisory/cve-2026-109618-cve-2026-109619/

#CensysARC #Cybersecurity #VulnerabilityManagement #PHP #InfoSec

PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.

If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.

Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

Нескучный октябрь.

> В целях снижения риска эксплуатации уязвимостей CVE-2026-109618 и
CVE-2026-109619 мы отключаем директиву session.upload_progress.enabled.
Некоторые функции сайтов, касающиеся индикации загрузки файлов станут недоступны.
> Патч безопасности затронет версии PHP выше 8.1, поэтому, по возможности, обновитесь до
последних версий PHP.
> Для версий ниже исправлений нет.

> Служба технической поддержки компании .masterhost

@Argyle13

📢 [VULN] ⚠️Serveurs PHP : préparez-vous à mettre à jour ce mercredi à 16 heures, deux failles critiques corrigées - CVE-2026-109618 CVE-2026-109619

Les serveurs du monde entier s’apprêtent à passer une fin de journée sous tension. Ce mercredi 21 octobre à 16 heures, le projet PHP va corriger en urgence deux failles majeures susceptibles de permettre la prise de contrôle à distance de millions de sites, de…

🔗 https://www.frandroid.com/culture-tech/3293371_failles-critiques-dans-php-alerte-maximale-et-mise-a-jour-durgence-ce-mercredi-a-16-h
💬 discussion : https://infosec.pub/post/53892596
#CVE #Cyberveille

Wenn statt Eurer Webseite grad das hier auftaucht,
wird im besten Fall nur deren Server mit dem richtigen Patch (Update) versehen

CVE-2026-109618
CVE-2026-109619

bzw

GHSA-w8hw-w9fx-j79w,
GHSA-6wmf-4rv5-p3rp

#php2shell

Regarding PHP2shell (CVE-2026-109618 and CVE-2026-109619) vulnerability, you obviously need to patch as quickly as possible but Cloudflare has implemented some mitigation's in it's default firewall that might buy you some time. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Hey! Five alarm #infosec fire! Government websites across Europe have been taken offline following the discovery of two critical security vulnerabilities in PHP, a programming language that underpins a massive portion of the internet.

On October 21, 2026, PHP developers announced emergency patches fixing two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, giving hackers the ability to take control of servers.

PHP is pervasive. It serves as the underlying engine for major content management systems like #WordPress, #Drupal and #Joomla.

Cybersecurity teams globally are being urged to immediately isolate any vulnerable, internet-facing PHP servers until official emergency updates (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) can be manually deployed.

Cloudflare has implemented temporary firewall mitigation rules, but experts stress this is only a stopgap measure.

Go patch your #php. Now.

https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/

Auf Grund der schwerwiegenden PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 sind meine Websites aktuell und für mehrere Stunden nicht erreichbar.

CC-4875 - Critical Vulnerabilities in PHP (PHP2Shell)

Severity: High

Successful exploitation of CVE-2026-109618 and CVE-2026-109619 could allow an unauthenticated attacker to execute code remotely or access sensitive memory

Successful exploitation of CVE-2026-109618 and CVE-2026-109619 could allow an unauthenticated attacker to execute code remotely or access sensitive memory

Updated: 21 Oct 2026

🚨 PHP2Shell: Critical RCE flaws in PHP. Patches are OUT.

CVE-2026-109618 & CVE-2026-109619 carry a CVSS 4.0 score of 9.2 and could enable unauthenticated remote code execution.

🔴 PHP 8.5.12, 8.4.27, 8.3.36 & 8.2.35 are patched.

⚠️ PHP 8.1 and older are EOL upstream. Upgrade to PHP 8.2+ or check your vendor for backported fixes.

We analyzed 7.2M PHP websites. 46.1% of sites revealing their version run EOL PHP.

The patch is out. Is your server protected?

Full technical breakdown, impact & remediation 👇
https://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/

#PHP #CyberSecurity #RCE #InfoSec

PHP Security Team Releases Emergency Patches for PHP2Shell Flaws

Critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, have been patched by the PHP security team to prevent unauthenticated remote code execution attacks. Immediate upgrades are urged across PHP-hosting infrastructure to safeguard against these flaws.

https://osintsights.com/php-security-team-releases-emergency-patches-for-php2shell-flaws?utm_source=mastodon&utm_medium=social

#Php2shell #RemoteCodeExecution #Cve2026109618 #Cve2026109619 #WebApplicationSecurity

RCE via stale global state (CVE-2026-109619):
- Set session.upload_progress.enabled=0 and restart every worker.
- On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
- Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup.

Dann werden heute noch alle Systeme aktualisiert. Zum Glück ist dazu nur eine kleine Anpassung des Automatismus notwendig cve-2026-109618 und cve-2026-109619 #php #cve #bsi

New.

Palo Alto: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products https://security.paloaltonetworks.com/CVE-2026-109618 #infosec #PHP #vulnerability

@mttaggart

Major Web Site Security Alert!

PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update immediately.

CISA POST:
"CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. " https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching #Security #CISA #PHP #CVE
#php2shell #SecurityPatch #SecurityAdvisory #Software #Risk #RemoteCodeExecution #RCE #WebSites #Internet #Web #WWW #CyberSecurity #CyberDefence

OK, sorted.

If you previously followed my example and ran #shotshare (https://www.bentasker.co.uk/posts/blog/general/deploying-shotshare-into-kubernetes.html) you're likely to be vulnerable to #php CVEs CVE-2026-109618 and CVE-2026-109619

Upstream looks to be abandoned, so I've forked and reworked the docker image to consume the fix (PR against upstream: https://github.com/mdshack/shotshare/pull/87)

In the meantime, I've pushed to my registries

* codeberg.org/bentasker/shotshare:202610-php-cve-bump
* bentasker12/shotshare:202610-php-cve-bump

Should be drop-in replacements

Claims of the PHP vulns being EITW:

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.

Here is what you need to know:

* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 

* The root is a decades-old design choice in PHP's error handling (described more in our post)

* There was evidence of in-the-wild exploitation pre-disclosure. 

The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application

We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.

What to do right now:

The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.

Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012. 

The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours. 

Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.

Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.

Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com

Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618

We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

#php2shell #php #CVE #eitw

New.

Google: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619 #Google #infosec #vulnerability #PHP

PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, two critical RCE flaws with reported exploitation. Widespread PHP use raises risk of mass compromise and outages, so prioritize patching and hunt for post-exploit activity. #PhpSecurity #RemoteCodeExecution #PatchNow

https://cyberworldops.eu/en/emergency-php-updates-address-two-critical-rce-flaws-amid-exploitation

PHP has released emergency fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical memory safety flaws in the PHP runtime that can allow unauthenticated code execution.

Upgrade now to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

🔗 https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619

watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.

https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

#eitw #php #php2shell #CVE

For those running pfSense+ (and possibly pfSense CE), it seems like PHP packages are starting to roll out:

https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619/15

#pfSense

Der Preis für die dümmste Teaser-Einleitung rund um CVE-2026-109618 und CVE-2026-109619 geht ganz klar an die #futurezone ....

»Es sollen die bisher schwerwiegendsten Sicherheitslücken sein, die je durch Künstliche Intelligenz aufgespürt wurden.«
https://futurezone.at/digital-life/php2shell-luecke-openai-google-70-prozent-des-internets/403199916

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the...

🔗️ [Securelist] https://link.is.it/nPWHOU

PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

Comments: https://news.ycombinator.com/item?id=50182987

#HackerNews #PHPFoundation #CVE2026 #SecurityUpdates #OpenSource #PHPSecurity

The path to happiness and posterity runs through PHP. Here is some of the research dealing with that today - so far.

KrebsonSecurity: Widespread PHP Flaw May Cause Many Site Outages Today https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/ @briankrebs

Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core

Cisco: Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ @TalosSecurity

CrowdStrike: Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/

Kaspersky: Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/ @Kaspersky

Sophos: Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 @SophosXOps

Palo Alto: Millions of PHP Instances Exposed - What Organizations Need To Do Right Now https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/

VulnCheck: PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 https://www.vulncheck.com/blog/php2shell-vulnerabilities @vulncheck

Socket: PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline https://socket.dev/blog/php-critical-rce-patches @SocketSecurity

Rapid7: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/ @Rapid7Official #vulnerability #threatresearch #infosec

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

#php #CISA #CVE

🚨 Rapid Response: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), can allow unauthenticated remote code execution across multiple PHP server configurations.

Censys ARC observes:
🔸 2,580,515 Internet-exposed hosts and 54,888,147 web properties running PHP
🔸 1,575,688 hosts reporting PHP versions older than the fixed releases

These figures do not represent confirmed vulnerable systems. Security fixes may be backported without changing reported version strings.

PHP has released security updates and recommends upgrading immediately.

Full advisory and Censys queries: https://censys.com/advisory/cve-2026-109618-cve-2026-109619/

#CensysARC #Cybersecurity #VulnerabilityManagement #PHP #InfoSec

PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.

If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.

Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

Нескучный октябрь.

> В целях снижения риска эксплуатации уязвимостей CVE-2026-109618 и
CVE-2026-109619 мы отключаем директиву session.upload_progress.enabled.
Некоторые функции сайтов, касающиеся индикации загрузки файлов станут недоступны.
> Патч безопасности затронет версии PHP выше 8.1, поэтому, по возможности, обновитесь до
последних версий PHP.
> Для версий ниже исправлений нет.

> Служба технической поддержки компании .masterhost

@Argyle13

Regarding PHP2shell (CVE-2026-109618 and CVE-2026-109619) vulnerability, you obviously need to patch as quickly as possible but Cloudflare has implemented some mitigation's in it's default firewall that might buy you some time. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Hey! Five alarm #infosec fire! Government websites across Europe have been taken offline following the discovery of two critical security vulnerabilities in PHP, a programming language that underpins a massive portion of the internet.

On October 21, 2026, PHP developers announced emergency patches fixing two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, giving hackers the ability to take control of servers.

PHP is pervasive. It serves as the underlying engine for major content management systems like #WordPress, #Drupal and #Joomla.

Cybersecurity teams globally are being urged to immediately isolate any vulnerable, internet-facing PHP servers until official emergency updates (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) can be manually deployed.

Cloudflare has implemented temporary firewall mitigation rules, but experts stress this is only a stopgap measure.

Go patch your #php. Now.

https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/

Auf Grund der schwerwiegenden PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 sind meine Websites aktuell und für mehrere Stunden nicht erreichbar.

PHP fixes two critical PHP RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing remote code execution. Update to 8.5.12 or 8.4.27.

#PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ModPHP #PatchNow #CyberSecurity

https://securityonline.info/php-rce-vulnerabilities-cve-2026-109618-109619/?utm_source=mastodon&utm_medium=jetpack_social

The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

The php2shell fix is out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Two critical bugs (CVSS 9.2), both remote code execution without authentication. mod_php has the highest risk, but PHP-FPM and other SAPIs are affected too. There are source backports for 7.4, 8.0 and 8.1.

Update, then do a full restart, not a reload.

Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

#PHP #InfoSec #CVE

🚨 Critical pre-authentication RCE research published for two PHP core vulnerabilities; CVE-2026-109618 + CVE-2026-109619

PoC: https://github.com/ikow/php2shell-poc

The flaws affect PHP's session.upload_progress handling and can be chained through session-file injection, memory corruption, or deserialization behavior to achieve remote code execution under specific application conditions.

CVSS: 9.2 Critical
Affected: PHP 5.4.0 through 8.5.11
Fixed: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12

The repository includes verification PoCs for session injection, a heap use-after-free, and handler-mismatch deserialization, along with a vulnerable Docker lab and detailed technical analysis.

📣 Announcing the immediate availability of:

- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12

‼️ These address the following critical security issues:

- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
:windows8: Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

#php2shell landed:

https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Wheeeeeeeee!

Unser Provider empfiehlt deutlich, die PHP-Seiten per Firewall/deny all komplett offline zu nehmen… bin gespannt, was um 16h00 disclosed wird (scheint ja in Richtung multiform upload handler zu gehen) #PHP #CVE-2026-109618 #CVE-2026-109619

PHP InfoSec

Wise system administrators who have caught wind of this bug have taken measures already

It hasn't been patched yet but you can mitigate exposure of your systems.
Better yet, do what is written on tweakers.net

Quotes:

Make your store read-only or take it offline

If you can afford to take a PHP server offline for a day, do so. PHP core developer Gina Peter Banyard calls that the most sensible option. Several Dutch sites went offline as a precaution on October 21: tech site Tweakers, the House of Representatives (Tweede Kamer), the National Cyber Security Centre (NCSC) and security news site Security.NL.

Stop PHP-FPM and have your web server show a static maintenance page. The maintenance modes built into Magento and WordPress do not help: PHP still parses each request before the application checks for the maintenance flag.

If you cannot go offline, make the store read-only. Have your web server reject every request method other than GET and HEAD, for example in nginx:

if ($request_method !~ ^(GET|HEAD)$) {
return 503;
}

Quote:

Websites overnemen

De twee kritieke kwetsbaarheden in PHP (CVE-2026-109618 en CVE-2026-109619) hebben een score van 9,2 op de CVSS v4.0-schaal, die tot 10 gaat. Dat hoge cijfer is gebaseerd op de ernst van een kwetsbaarheid en op hoe makkelijk aanvallers die kunnen misbruiken. De kwetsbaarheden zouden al sinds versie 5.4.0 in PHP zitten, die in maart 2012 uitkwam. Aanvallers kunnen door de kwetsbaarheden eigen webpagina's publiceren. Daardoor kunnen zij mogelijk malware verspreiden. Daarnaast zou de zogeheten PHP2Shell-exploit het mogelijk maken om eigen code uit te voeren op kwetsbare servers.

Volgens verschillende beveiligingsadviezen kan het helpen om session.upload_progress.enabled uit te schakelen. Een bijbehorende tijdelijke oplossing zou zijn om session.use_strict_mode in te schakelen. Beveiligingsexpert Kevin Beaumont meldt dat de Linux-kernelbeveiligingsmodule AppArmor of SELinux ook bescherming biedt tegen misbruik van deze grote PHP-kwetsbaarheden.

I understand the NL language
Translate this if you don't

Jump to the sources read and work

Sources:

https://jackalsyn.com/posts/php-up-2026.html

https://sansec.io/research/php2shell

https://tweakers.net/

#PHP #bug #serious #infoSEC #programming #upgrade

🚨 If you run PHP (like most of the internet does), this one can’t wait: #PHP2Shell = 2 critical RCE flaws in PHP core leaked before the patch, with live attacks already reported.

Because CVE-2026-109618 & CVE-2026-109619 sit in PHP itself, every app on a vulnerable PHP version is exposed, no matter what runs on top.

That’s why we’re building detection in our Network Scanner + an exploit module in Sniper as you’re reading this. Stay tuned for the launch announcement!

What to do now:

Inventory every PHP install, including control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
Patch as soon as PHP’s release is out, then restart PHP-FPM or your web server
On PHP 8.1 or older? No fix is coming. Upgrade, or take those systems off the internet
Alert on PHP processes spawning shells, interpreters, or download tools

#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking

@thomasfuchs that's spooky. Remote-code execution 😬

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

> From what has been reported, the flaws are in how PHP processes file-upload requests. When a browser sends a form that contains a file, it uses a multipart/form-data request, which is a request body split into separate parts for each field and file. PHP reads and splits that body itself before your application code runs.

Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)
#CVE_2026_109618 #CVE_2026_109619
https://watchtowr.com/intelligence/php-cve-2026-109618-faq/

🔧 Dočasně vypínáme podporu přes FreeScout (helpdesk.oscloud.cz) kvůli kritické chybě v PHP. Znovu ji zapneme po aplikování opravy.

⚠️ Kritická zranitelnost v PHP, co to znamená pro OSCloud

PHP tým oznámil dvě kritické chyby (CVE-2026-109618 a CVE-2026-109619, obě CVSS 9.2). Mohou umožnit spuštění cizího kódu na serveru bez přihlášení. Oprava vychází dnes v 16:00 SEČ/CEST. Podle hlášení bezpečnostních firem už probíhají první útoky.

Kterých služeb se to týká:
• Nextcloud, WordPress, Pixelfed, FreeScout, a další aplikace postavené na PHP
• LAMP weby zákazníků (Apache + PHP), včetně těch, kde zatím běží jen úvodní stránka

Kterých ne:
• Mastodon, Matrix, PeerTube, Gitea (PHP nepoužívají)
• Weby a úložiště na statických souborech (Surfer)

Co děláme:
• FreeScout jsme vypnuli
• Další PHP aplikace a LAMP weby budeme vypínat postupně a vždy o tom budeme informovat zde. Počítejte s tím, že dočasně vypneme i Nextcloud, a to do vydání a nasazení opravy
• Jakmile budou dostupné opravené verze aplikací, nasadíme je co nejdřív
• Před vypnutím a updaty děláme zálohy

Co to znamená pro vás:
• Podpora přes FreeScout je do opravy nedostupná
• Nextcloud, LAMP weby a další PHP služby mohou být dnes nedostupné
• Pokud by se při updatu něco pokazilo, vracíme se ze zálohy maximálně 12 hodin zpět

Opravu nelze řešit pluginy ani updatem WordPressu, musí přijít nové PHP v rámci aktualizace aplikace. Pokud provozujete vlastní PHP web mimo OSCloud, aktualizujte PHP hned, jak vyjde oprava.

Děkujeme za trpělivost. Stav budeme průběžně aktualizovat v tomto vlákně.

#OSCloud #PHP #Bezpečnost

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) https://isc.sans.edu/diary/33440

Milhões de servidores PHP expostos ao risco da falha PHP2Shell. A recente divulgação de detalhes técnicos sobre as vulnerabilidades críticas no PHP (CVE-2026-109618 e CVE-2026-109619) acendeu os alertas no setor. 🚨

🔗 https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell

#apache #dados #equipa #falha #risco 

Die zentralen Websites der Uni Freiburg sind vom Netz genommen worden. #PHP

https://rz.uni-freiburg.de/de/rz/aktuell/stoerungen/2026-10-21-10-39-massnahme-im-zusammenhang-mit-der-kritischen-schwachstelle-php-cve-2026-109618-und-cve-2026-109619

php2shell: Dissecting PHP's Critical Session Upload Progress Vulnerabilities

CVE-2026-109618 & CVE-2026-109619 — From source code audit to three independent RCE chains

🔗️ [Substack] https://link.is.it/lp3FMf

CVE-2026-109618 & CVE-2026-109619: CRITICAL RCE in PHP (>=5.0.0). Patch lands Oct 21; only PHP 8.x supported. Mass exploitation likely post-release. Prepare to patch ASAP. Details: https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c #OffSeq #PHP #vuln #RCE

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress

Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.

🔗️ [Huntress] https://link.is.it/Q3tPnD

🚨 Critical Alert from Karen IT
Two critical unauthenticated RCE vulnerabilities in PHP (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) have leaked early.

https://ksrc.karenit.net/blog/security-alert/urgent-php-remote-code-execution-vulnerabilities-(cve-2026-109618-&-cve-2026-109619)

Do not delay.

#PHP #RCE #CVE #CyberSecurity

🚨 تنبيه حرج
ثغرتان حرجتان في PHP تسمحان بتنفيذ أكواد عن بُعد بدون مصادقة (CVE-2026-109618 و CVE-2026-109619، CVSS 9.2) تم تسريبهما مبكراً.
لا تتأخروا.

#PHP #ثغرات #أمن_سيبراني

PHP : deux failles critiques ont fuité avant l’heure, un correctif d’urgence arrive ce 21 octobre ! https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #PHP

#php2shell
Ok, dann werden wir mal unsere Server absichern, bis es entsprechende gepatchte Versionen von PHP gibt
Im Artikel sind entsprechende Maßnahmen gut beschrieben und erklärt, und auch, was nicht funktioniert.

Da ältere Versionen als #PHP82 keine Patches erhalten werden, muss ich diese wohl eben manuell absichern. (ja, ich nutze auch noch ältere Versionen)

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

#devadmin #serveradmin #cve #php #phpsecurity #phppatch #security

>当該脆弱性を悪用できると主張するコードが、既にインターネット上に出回り始めています（2026/10/21 14時 日本時間 追記）。

PHPの重大な脆弱性「php2shell」（CVE-2026...

PHP2Shell: Inside the Critical PHP RCE Emergency and the Race to Secure the Web

https://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/

@gunchleoc @GossiTheDog
Thanks, I updated my blog post mentioning heise and https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

I will not link to sources and you don't have to trust me, but there are already exploits out there, one of them will get you a shell on servers running WordPress. So this is a critical update. CVE-2026-109618 and CVE-2026-109619 seem to affect all PHP versions going back to 5.4 and could result in RCE (Remote Code Execution).

#SysAdminLife @homelab

@pulsar Thanks!

TL;DR: Details of two critical holes in PHP leaked before a fix was ready. They’re in how PHP handles file uploads and could let attackers run their own code on your server. Possibly affects PHP 5 through 8. Fixes are due today at 14:00 UTC, and attacks are expected within minutes of release.

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

The bug sits below WordPress or Laravel, so having no upload form doesn’t protect you, and nor do security plugins or maintenance mode.

Until the patch: list every server running PHP, including old staging sites. Switch off PHP’s upload-progress setting, and get your web server to refuse upload-style requests before they reach PHP. That breaks uploads for a few hours, which is the trade-off.

Once the fix lands: update every PHP version on every server, restart PHP and any background workers, and rebuild Docker images. PHP 8.1 and older won’t get a fix, so upgrade or take them offline. On managed hosting, ask your host to confirm.

PHP Issues Emergency Warning for Critical Remote Code Execution Vulnerabilities

PHP is releasing emergency patches for two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). The release follows a data leak that forced the development team to move the disclosure date earlier to limit exploitation.

**If you run any website or app built on PHP (WordPress, online shops, internal tools), install the emergency security updates as soon as they're released today at 14:00 UTC. Until you've patched, restrict access to internal PHP systems and admin pages to trusted networks only, and monitor your servers closely for unusual logins, new files or strange activity.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/php-issues-emergency-warning-for-critical-remote-code-execution-vulnerabilities-y-t-1-8-c/gD2P6Ple2L

looks like some PHP RCE (CVE-2026-109618 / CVE-2026-109619 / PHP-UP-2026) deets started to drop.

as a LAMP shared webhoster we're obviously Very Excited™

https://jackalsyn.com/posts/php-up-2026.html

php2shell、影響範囲が広すぎてLog4Shell以来、あるいはそれ以上の騒ぎになってる

/ PHPの重大な脆弱性「php2shell」（CVE-2026-109618、CVE-2026-109619）の概要と対応指針 - GMO Flatt Security Blog https://blog.flatt.tech/entry/php2shell

@falken There are CVEs now, but no patches expected till 14:00 UTC, and at least one proof-of-concept exploit actively circulating.

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

🚨 There is a critical flaw in PHP that leads to remote code execution. A patch is has not been released yet.

If you run DokuWiki or any other PHP software, I would recommend shutting down the webserver until official mitigation steps and/or a patch is available.

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

in php.ini:
 session.upload_progress.enabled = Off
 session.use_strict_mode = 1

mitigates the current public PoCs that may or may not be for CVE-2026-109618 / CVE-2026-109619

whether this is a true mitigation or AI hallucination I don't actually know

christ, there are apparently public PoCs for CVE-2026-109618 and CVE-2026-109619

PHP's notice names no bug type, CVE IDs or affected versions for two critical flaws (CVSS v4.0 9.2 each) due to be fixed Oct 21 at 14:00 UTC, sooner if details go public. A leak says RCE, CVE-2026-109618 and CVE-2026-109619, PHP 5 onward. watchTowr, a security testing vendor, says it confirmed the leak, but its FAQ calls the scope unverified. PHP supports only 8.2 to 8.5.

https://news-web.php.net/php.announce/509

#PHP #InfoSec #Cybersecurity

🏆 New Achievement! Embargo This, Actually!

Your Q4 infrastructure review is in, and the numbers look great — uptime solid, tickets closed, coffee budget approved. One small note in the "Areas for Improvement" column: somebody leaked two critical PHP 8 zero-days rated CVSS 9.2 a full day before the embargo lifted, forcing the PHP security team to rush an emergency release to October 21 at 14:00 UTC. CVE-2026-109618 and CVE-2026-109619 are remote code execution flaws in PHP core. (1/2)

A PHP security release on Oct 21 fixes two CVSS 9.2 flaws, CVE-2026-109618 and CVE-2026-109619, leaked as remote code execution bugs.

#PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ZeroDay #PatchNow #CyberSecurity

https://securityonline.info/php-security-release-cve-2026-109618-109619/?utm_source=mastodon&utm_medium=jetpack_social

@veronica I'm sure you know, but for anyone following here using Ubuntu's PHP packages:

You will still see the old version when hitting `php -v`even after updating, because Ubuntu backported the fixes.

You can check the installed version with `dpkg -s php8.3-cli` and on 24.04 LTS (Noble Numbat) if the output contains `Version: 8.3.6-0ubuntu0.24.04.13` you're good to go. See https://ubuntu.com/security/CVE-2026-109618 for version strings for other Ubuntu releases.

New.

Palo Alto: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products https://security.paloaltonetworks.com/CVE-2026-109618 #infosec #PHP #vulnerability

@mttaggart

Notable PHP Enjoyer Palo Alto has posted their advisory on #PHP2Shell:

https://security.paloaltonetworks.com/CVE-2026-109618

ALL versions of Panorama and PAN-OS are affected. There's a fix coming, but right now I recommend shutting down anything exposed publicly, like VPN portals.

Must-read blog post from the PHP foundation:

> [ In 2024 ] a PHP core developer contracted by the PHP Foundation found the first signs of the [out-of-memory] OOM problem behind CVE-2026-109618.

> the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#php2shell

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #programmingAtKukei https://masto.kukei.eu/browse/programming category:
Here are the key topics dominating the discussion in these Mastodon posts:

1. **Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619)**
- Widespread concern over two severe RCE flaws in PHP (CVSS 9.2) affecting versions from PHP 5 onward. Patches released on October 21, 2026, with urgent calls to update or disable PHP services. [1/4]

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #technologyAtKukei https://masto.kukei.eu/browse/technology category:
- **Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)**
- Two critical remote code execution flaws in PHP affecting versions from PHP 5 onward. Patches released on October 21, 2026, with widespread impact on web servers globally.

- **eMudhra CA private key compromise**
- Eight intermediate CA certificates compromised, with [1/3]

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #newsAtKukei https://masto.kukei.eu/browse/news category:
- **Critical PHP vulnerabilities (PHP2Shell)**: Two severe flaws in PHP (CVE-2026-109618, CVE-2026-109619) led to widespread website outages, with admins urged to patch immediately.
- **Galaxy S27 leaks**: Samsung may reduce memory and raise prices for the upcoming Galaxy S27 series.
- **AfD data leaks**: Hackers exposed internal AfD [1/3]

RT: @Burp_Suite 🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST.

Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using:

🟧 ActiveScan++ v2.0.13 ()
🟧 Bambda scan checks ()
🟧 BChecks ()

Start scanning for the vulnerability now →

PHP's CVSS 9.2 fixes: Memory exhaustion and stale request state

PHP가 CVSS v4 9.2로 평가된 두 메모리 안전성 취약점(CVE-2026-109618, CVE-2026-109619)을 긴급 패치했다. 첫 번째는 메모리 부족(OOM) 발생 시 `zend_bailout()`이 정리 절차를 건너뛰어 미완성 내부 객체가 사용될 수 있는 문제로, 조작된 업로드 요청을 통해 Apache mod_php에서 인증 없이 원격 코드 실행(RCE)으로 이어질 수 있다. 두 번째는 재사용되는 워커가 이전 요청의 해제된 세션·백트레이스 관련 상태를 다음 요청에서 참조할 수 있는 stale request state 문제이며, mod_php와 PHP-FPM에서...

https://jdstaerk.substack.com/p/php-emergency-fix

PHP2Shell Explained: PHP2Shell Was in the Training Data

글은 PHP 코어의 CVE-2026-109618·CVE-2026-109619(통칭 PHP2Shell)가 요청 처리 중 메모리 부족(OOM)과 C의 longjmp 기반 예외 탈출을 악용해 메모리 노출 및 원격 코드 실행으로 이어질 수 있다고 설명합니다. 핵심 원인은 multipart/form-data 파서에서 제한을 우회해 정밀하게 OOM을 유발하고, 그 과정에서 초기화되지 않은 엔트리나 요청 종료 후 남은 전역 dangling pointer를 남기는 것입니다. 영향을 받을 수 있는 공개 PHP 배포 환경은 PHP 8.5.12, 8.4.27, 8.3.36, 8...

https://deadneurons.substack.com/p/php2shell-explained-php2shell-was

What the PHP2Shell rumors got wrong, from inside the PHP security team

PHP 보안팀 관점에서 PHP2Shell 루머와 실제 취약점(CVE-2026-109618, CVE-2026-109619)을 대조하며, 핵심 RCE는 기본 설정의 Apache mod_php에서 애플리케이션 코드 실행 전 원격으로 트리거될 수 있다고 설명합니다. 주된 원인은 memory_limit 초과 시 Zend allocator가 longjmp로 요청 초기화 중인 C 코드의 실행을 중단하고, 미완성 상태의 요청 구조체가 shutdown 단계에서 사용되며 발생하는 메모리 손상입니다. 패치된 PHP 8.2.35·8.3.36·8.4.27·8.5.12는 a...

https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

Cloudflare deploys protections against php2shell vulnerability

PHP 5.4 이상 런타임에 영향을 주는 php2shell(CVE-2026-109618, CVE-2026-109619)은 비정상적인 HTTP 요청 처리 중 메모리 초기화·해제 오류를 악용해 서비스 거부, 민감 정보 노출, 원격 코드 실행으로 이어질 수 있는 중대 취약점이다. WordPress와 Magento를 포함해 광범위한 PHP 기반 서비스가 영향을 받을 수 있으며, 공개 전 유출된 뒤 실제 공격 트래픽과 WAF 우회용 페이로드 변형도 관측됐다. Cloudflare는 모든 WAF 플랜에 관리형 탐지를 기본 배포했으며, 요청뿐 아니라 원본 응답까지 같은...

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Patch the Planet

OpenAI의 Daybreak 이니셔티브가 Trail of Bits, Calif, HackerOne과 협력해 오픈소스 보안 취약점을 검증·패치·책임 공개하는 프로그램인 ‘Patch the Planet’을 공개했다. 첫 공개 사례인 php2shell은 CVE-2026-109618 및 CVE-2026-109619로 추적되는 PHP의 치명적 취약점으로, 영향받는 서버에서 인증되지 않은 공격자가 원격 코드 실행을 할 수 있다고 설명한다. 유지보수자가 릴리스 통제권을 유지하는 방식으로 패치와 공개를 지원하며, 장기적으로 테스트·퍼징·보안 워크플로도 제공한다. PHP 운영 환경 및 이를 의존하는 AI 서비스는 해당 CVE의 영향 버전과 배포된 패치를 즉시 확인할 필요가 있다.

https://patchtheplanet.org/

#php #security #rce #opensource #vulnerability

Unauthenticated RCE in PHP via stale global state

PHP 엔진의 OOM 처리와 요청 간 전역 상태 정리 결함을 악용하면, 지속 워커를 사용하는 Apache mod_php 및 일부 PHP-FPM 환경에서 인증 없이 원격 코드 실행(RCE)이 가능하다는 보안 분석이다. CVE-2026-109618은 `memory_limit` 초과 시 `longjmp()` 기반 bailout이 반쯤 초기화된 요청 상태를 남기는 문제이고, CVE-2026-109619는 이전 요청 힙을 가리키는 전역 상태가 다음 요청에서 사용되는 use-after-free 문제다. 멀티파트 요청, 세션 업로드 진행률, 요청 초기화 전 적용되는 INI 설정 진단 등이 공격 경로가 될 수 있으며, mod_php에서 HTTP 기반...

https://markdown.page/AzvY2d69

🚨 PHP 8.5.12 may STILL be vulnerable to PHP2Shell.

The release was supposed to patch CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities rated CVSS 9.2.

But if reports of a remaining attack path are confirmed, even upgrading to PHP 8.5.12 may not be enough.

⚠️ Don't assume you're safe just because your version number matches the patched release. Verify the latest PHP security advisories before declaring your servers protected.

Full technical breakdown 👇
https://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/

#PHP #InfoSec #RCE

Major Web Site Security Alert!

PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update immediately.

CISA POST:
"CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. " https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching #Security #CISA #PHP #CVE
#php2shell #SecurityPatch #SecurityAdvisory #Software #Risk #RemoteCodeExecution #RCE #WebSites #Internet #Web #WWW #CyberSecurity #CyberDefence

OK, sorted.

If you previously followed my example and ran #shotshare (https://www.bentasker.co.uk/posts/blog/general/deploying-shotshare-into-kubernetes.html) you're likely to be vulnerable to #php CVEs CVE-2026-109618 and CVE-2026-109619

Upstream looks to be abandoned, so I've forked and reworked the docker image to consume the fix (PR against upstream: https://github.com/mdshack/shotshare/pull/87)

In the meantime, I've pushed to my registries

* codeberg.org/bentasker/shotshare:202610-php-cve-bump
* bentasker12/shotshare:202610-php-cve-bump

Should be drop-in replacements

Claims of the PHP vulns being EITW:

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.

Here is what you need to know:

* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 

* The root is a decades-old design choice in PHP's error handling (described more in our post)

* There was evidence of in-the-wild exploitation pre-disclosure. 

The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application

We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.

What to do right now:

The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.

Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012. 

The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours. 

Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.

Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.

Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com

Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618

Kritisches PHP-Sicherheitsproblem: Websites offline

Sogar das BSI hat schon eine dringende Warnung veröffentlicht. Etwas hilfreicher ist der Text von Brian Krebs. Die besten und vor allem aktuellen Informationen gibt es beim SANS-ISC.
Beim jetzigen Kenntnisstand stellt sich die Lage so dar: In der FOSS Programmiersprache PHP wurden zwei Sicherheitslücken gefunden, die jetzt die Nummern CVE-2026-109618 und CVE-2026-109619 erhalten haben. Die zugrunde liegenden Schwachstellen existieren schon seit der Steinzeit, aber bisher war ihre eventuelle Ausnutzung so kompliziert, dass sie keine Gefahr darstellten. Mit Auftreten der KI hat sich das geändert. ... Weiterlesen:

https://www.pc-fluesterer.info/wordpress/2026/10/21/kritisches-php-sicherheitsproblem-websites-offline/

#0day #cms #exploits #KI #provider #sicherheit #vorbeugen #wissen

📢 PHP2Shell : deux vulnérabilités RCE critiques CVE-2026-109618 et CVE-2026-109619 patchées en urgence

L'article couvre la fuite prématurée de deux vulnérabilités critiques PHP et la réponse d'urgence de l'équipe PHP. Le 20 octobre 2026, un post sur Hacker News a révélé l'existence de deux vulnérabilités critiques PHP (CVE-2026-109618 et CVE-2026-109619) avant leur…

📖 cyberveille : https://cyberveille.ch/posts/2026-10-21-php2shell-deux-vulnerabilites-rce-critiques-cve-2026-109618-et-cve-2026-109619-patchees-en-urgence/
🌐 source : https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
🟢 vérification factuelle haute
#PHP #RCE #Cyberveille

We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

#php2shell #php #CVE #eitw

New.

Google: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619 #Google #infosec #vulnerability #PHP

PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, two critical RCE flaws with reported exploitation. Widespread PHP use raises risk of mass compromise and outages, so prioritize patching and hunt for post-exploit activity. #PhpSecurity #RemoteCodeExecution #PatchNow

https://cyberworldops.eu/en/emergency-php-updates-address-two-critical-rce-flaws-amid-exploitation

PHP2Shell

PHP 코어의 메모리 안전성 취약점군 ‘PHP2Shell’(CVE-2026-109618, CVE-2026-109619)이 공개됐으며, CVSS 9.2로 인증 없이 PHP 워커에서 원격 코드 실행(RCE) 또는 프로세스 메모리 유출을 일으킬 수 있습니다. 공격은 WordPress·Drupal·Joomla에 국한되지 않으며, 취약한 PHP 런타임 위의 단순 애플리케이션도 영향을 받을 수 있고 메모리에서 API 키·토큰·비밀번호·인증서가 노출될 수 있습니다. PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 이상으로 모든 런타임을 업데이트한 뒤 Apache, PHP-FPM 및 장기 실행 워커를 재시작해야 합니다. 즉시 패치가 불가하면 메모리·입력 크기·워커 재사용을 제한하는 완화책을 검토할 수 있지만, 이는...

https://www.php2shell.com

A tale of two PHP remote vulnerabilities

PHP 5.4.0 이상에 영향을 주는 CVE-2026-109618 및 CVE-2026-109619는 `memory_limit` 초과로 발생한 fatal error가 네이티브 코드의 정리 절차를 중단시키면서, 요청 종료 시 stale 상태를 해제하도록 만들어 원격 코드 실행(RCE)으로 이어질 수 있는 취약점이다. 연구진은 chunked/HTTP2 multipart 요청 또는 중첩된 빈 파일 업로드를 이용해 기본 `post_max_size` 제약 아래에서도 메모리 고갈을 유도하고, 부분 초기화된 HashTable bucket을 teardown이 소비하게 만드는 경로를 제시했다. 기본 구성에서 Apache mod_php 및 일부 PHP-FPM 경로에 신뢰성...

https://calif.io/php2shell.x/

PHP has released emergency fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical memory safety flaws in the PHP runtime that can allow unauthenticated code execution.

Upgrade now to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

🔗 https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619

PHP 8.2.35

PHP 8.2.35는 인증 없이 원격 코드 실행이 가능한 치명적 취약점 2건(CVE-2026-109618, CVE-2026-109619)을 수정한 보안 릴리스다. 완전한 완화책이 없으며, PHP 8.2을 운영하는 서비스는 즉시 해당 버전 또는 지원되는 최신 PHP 버전으로 업데이트해야 한다. PHP 기반 AI 서비스의 API 서버, 작업 큐 워커, 플러그인·CMS 연동 백엔드도 공격 표면이 될 수 있으므로 이미지 태그, CI 의존성, 런타임 배포 버전을 함께 점검해야 한다. PHP 8.2의 지원은 2026년 12월 31일 종료되므로 장기적으로는 지원 버전으로의 업그레이드 계획이 필요하다.

https://github.com/php/php-src/releases/tag/php-8.2.35

#php #security #rce #cve #supplychain

What the PHP2Shell rumors got wrong, from inside the PHP security team https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

Palo finally published an advisory:

https://security.paloaltonetworks.com/CVE-2026-109618

No patch but some customers can get detections. Thanks, Palo. Fucking worthless fucks.

Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.

After publication of the vulnerability and patches, Advanced Threat Prevention (ATP) will release standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625), on Oct 21st.

The security risk posed by this issue on PAN-OS is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.

PHP Vulnerabilities Expose Millions to Remote Code Execution Risk

Millions are at risk of remote code execution due to critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting versions from 5.4.0 across PHP series 5, 6, 7, and 8. Patches were swiftly released on October 21, 2026, to mitigate these highly severe flaws.

https://osintsights.com/php-vulnerabilities-expose-millions-to-remote-code-execution-risk?utm_source=mastodon&utm_medium=social

#RemoteCodeExecution #PhpVulnerabilities #Cve2026109618 #Cve2026109619 #EmergingThreats

PHP Vulnerabilities Spark Widespread Exploitation Fears

A critical alert has been issued for PHP users, with nearly 70% of websites needing to update their core software to patch two severe vulnerabilities that could give attackers full control over affected servers. These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are already being exploited, causing outages and…

https://osintsights.com/php-vulnerabilities-spark-widespread-exploitation-fears?utm_source=mastodon&utm_medium=social

#PhpVulnerabilities #Cve2026109618 #Cve2026109619 #WebApplicationSecurity #EmergingThreats

watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.

https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

#eitw #php #php2shell #CVE

"Plusieurs vulnérabilités critiques découvertes dans #PHP : installez immédiatement les mises à jour de sécurité"

"Deux vulnérabilités critiques dans PHP pourraient permettre à un attaquant d'exécuter du code malveillant sur les serveurs concernés sans avoir à s’authentifier. Des mises à jour de sécurité sont désormais disponibles. L'Office fédéral de la cybersécurité (OFCS) recommande de mettre à jour immédiatement les systèmes concernés. Outre les serveurs web, vérifiez également les applications et les appareils qui utilisent PHP comme composant intégré."
👇
https://www.bacs.admin.ch/fr/warnung-php-fr

🔍
👇
https://security-hub.ncsc.admin.ch/#/posts/13083

🇪🇺
👇
https://db.gcve.eu/vuln/CVE-2026-109618

#CyberVeille #PHP2shell

For those running pfSense+ (and possibly pfSense CE), it seems like PHP packages are starting to roll out:

https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619/15

#pfSense

Der Preis für die dümmste Teaser-Einleitung rund um CVE-2026-109618 und CVE-2026-109619 geht ganz klar an die #futurezone ....

»Es sollen die bisher schwerwiegendsten Sicherheitslücken sein, die je durch Künstliche Intelligenz aufgespürt wurden.«
https://futurezone.at/digital-life/php2shell-luecke-openai-google-70-prozent-des-internets/403199916

Google Cloud response to core PHP vulnerabilities
https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619
#googlecloud #php

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the...

🔗️ [Securelist] https://link.is.it/nPWHOU

PHP Disrupts Code Execution Flaws with Emergency Patches

PHP has urgently released patches for two critical code execution flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 in severity, that can put nearly every PHP installation at risk. Updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 is crucial to protect your server from these vulnerabilities.

https://osintsights.com/php-disrupts-code-execution-flaws-with-emergency-patches?utm_source=mastodon&utm_medium=social

#Php #CodeExecution #Cve2026109618 #Cve2026109619 #RemoteCodeExecution

PHP Developers Rush to Patch Critical Vulnerabilities

PHP developers, beware: two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been discovered, allowing unauthenticated remote code execution, and emergency patches have been released to fix the issue. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 ASAP to protect your applications from potential…

https://osintsights.com/php-developers-rush-to-patch-critical-vulnerabilities?utm_source=mastodon&utm_medium=social

#PhpVulnerabilities #RemoteCodeExecution #Cve2026109618 #Cve2026109619 #WebApplicationSecurity

PHP has released emergency updates for two severe runtime vulnerabilities named PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2.

The flaws affect nearly all PHP versions back to PHP 5.4.

Researchers noted that AI assisted in turning old primitives into working exploits, while Cloudflare observed early attack attempts before patches shipped.

Fixes are included in versions 8.5.12, 8.4.27, 8.3.36…

https://en.hacks.gr/epeigoyses-enimeroseis-asfaleias-gia-tin-php-logo-sovaron-kenon/

#PHP #PHP2Shell #CVE2026109618 #WebDev

PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619 - https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#hackernews

PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

Comments: https://news.ycombinator.com/item?id=50182987

#HackerNews #PHPFoundation #CVE2026 #SecurityUpdates #OpenSource #PHPSecurity

The path to happiness and posterity runs through PHP. Here is some of the research dealing with that today - so far.

KrebsonSecurity: Widespread PHP Flaw May Cause Many Site Outages Today https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/ @briankrebs

Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core

Cisco: Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ @TalosSecurity

CrowdStrike: Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/

Kaspersky: Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/ @Kaspersky

Sophos: Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 @SophosXOps

Palo Alto: Millions of PHP Instances Exposed - What Organizations Need To Do Right Now https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/

VulnCheck: PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 https://www.vulncheck.com/blog/php2shell-vulnerabilities @vulncheck

Socket: PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline https://socket.dev/blog/php-critical-rce-patches @SocketSecurity

Rapid7: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/ @Rapid7Official #vulnerability #threatresearch #infosec

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

#php #CISA #CVE

🚨 Rapid Response: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), can allow unauthenticated remote code execution across multiple PHP server configurations.

Censys ARC observes:
🔸 2,580,515 Internet-exposed hosts and 54,888,147 web properties running PHP
🔸 1,575,688 hosts reporting PHP versions older than the fixed releases

These figures do not represent confirmed vulnerable systems. Security fixes may be backported without changing reported version strings.

PHP has released security updates and recommends upgrading immediately.

Full advisory and Censys queries: https://censys.com/advisory/cve-2026-109618-cve-2026-109619/

#CensysARC #Cybersecurity #VulnerabilityManagement #PHP #InfoSec

PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.

If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.

Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

Нескучный октябрь.

> В целях снижения риска эксплуатации уязвимостей CVE-2026-109618 и
CVE-2026-109619 мы отключаем директиву session.upload_progress.enabled.
Некоторые функции сайтов, касающиеся индикации загрузки файлов станут недоступны.
> Патч безопасности затронет версии PHP выше 8.1, поэтому, по возможности, обновитесь до
последних версий PHP.
> Для версий ниже исправлений нет.

> Служба технической поддержки компании .masterhost

@Argyle13

📢 [VULN] ⚠️Serveurs PHP : préparez-vous à mettre à jour ce mercredi à 16 heures, deux failles critiques corrigées - CVE-2026-109618 CVE-2026-109619

Les serveurs du monde entier s’apprêtent à passer une fin de journée sous tension. Ce mercredi 21 octobre à 16 heures, le projet PHP va corriger en urgence deux failles majeures susceptibles de permettre la prise de contrôle à distance de millions de sites, de…

🔗 https://www.frandroid.com/culture-tech/3293371_failles-critiques-dans-php-alerte-maximale-et-mise-a-jour-durgence-ce-mercredi-a-16-h
💬 discussion : https://infosec.pub/post/53892596
#CVE #Cyberveille

Wenn statt Eurer Webseite grad das hier auftaucht,
wird im besten Fall nur deren Server mit dem richtigen Patch (Update) versehen

CVE-2026-109618
CVE-2026-109619

bzw

GHSA-w8hw-w9fx-j79w,
GHSA-6wmf-4rv5-p3rp

#php2shell

Regarding PHP2shell (CVE-2026-109618 and CVE-2026-109619) vulnerability, you obviously need to patch as quickly as possible but Cloudflare has implemented some mitigation's in it's default firewall that might buy you some time. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Matrix über die PHP-Releases:

https://ma.ttias.be/php-cve-2026-109618-patch/#package-status

#nextcloud #php

Hey! Five alarm #infosec fire! Government websites across Europe have been taken offline following the discovery of two critical security vulnerabilities in PHP, a programming language that underpins a massive portion of the internet.

On October 21, 2026, PHP developers announced emergency patches fixing two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, giving hackers the ability to take control of servers.

PHP is pervasive. It serves as the underlying engine for major content management systems like #WordPress, #Drupal and #Joomla.

Cybersecurity teams globally are being urged to immediately isolate any vulnerable, internet-facing PHP servers until official emergency updates (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) can be manually deployed.

Cloudflare has implemented temporary firewall mitigation rules, but experts stress this is only a stopgap measure.

Go patch your #php. Now.

https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/

Auf Grund der schwerwiegenden PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 sind meine Websites aktuell und für mehrere Stunden nicht erreichbar.

CC-4875 - Critical Vulnerabilities in PHP (PHP2Shell)

Severity: High

Successful exploitation of CVE-2026-109618 and CVE-2026-109619 could allow an unauthenticated attacker to execute code remotely or access sensitive memory

Successful exploitation of CVE-2026-109618 and CVE-2026-109619 could allow an unauthenticated attacker to execute code remotely or access sensitive memory

Updated: 21 Oct 2026

PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and...

🔗️ [Bleepingcomputer] https://link.is.it/LMjG6I

PHP2SHELL Patches have been released for PHP version 8.2 and up. Update IMMEDIATELY. Read more: https://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/

Jesus Christ patch your shit now

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-109618/

Jesus Christ patch your shit n...

Jesus Christ patch your shit now

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-109618/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

@RensBloom I am also awaiting the update for Ubuntu. It got applied quickly (https://ubuntu.com/security/CVE-2026-109618#status) but now is the wait till all mirrors are updated I guess. Or manually add a repo which has the update.

🚨 PHP2Shell: Critical RCE flaws in PHP. Patches are OUT.

CVE-2026-109618 & CVE-2026-109619 carry a CVSS 4.0 score of 9.2 and could enable unauthenticated remote code execution.

🔴 PHP 8.5.12, 8.4.27, 8.3.36 & 8.2.35 are patched.

⚠️ PHP 8.1 and older are EOL upstream. Upgrade to PHP 8.2+ or check your vendor for backported fixes.

We analyzed 7.2M PHP websites. 46.1% of sites revealing their version run EOL PHP.

The patch is out. Is your server protected?

Full technical breakdown, impact & remediation 👇
https://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/

#PHP #CyberSecurity #RCE #InfoSec

PHP Security Team Releases Emergency Patches for PHP2Shell Flaws

Critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, have been patched by the PHP security team to prevent unauthenticated remote code execution attacks. Immediate upgrades are urged across PHP-hosting infrastructure to safeguard against these flaws.

https://osintsights.com/php-security-team-releases-emergency-patches-for-php2shell-flaws?utm_source=mastodon&utm_medium=social

#Php2shell #RemoteCodeExecution #Cve2026109618 #Cve2026109619 #WebApplicationSecurity

Dann werden heute noch alle Systeme aktualisiert. Zum Glück ist dazu nur eine kleine Anpassung des Automatismus notwendig cve-2026-109618 und cve-2026-109619 #php #cve #bsi

Wer nicht updaten kann:
RCE via OOM corruption (CVE-2026-109618):
- Set memory_limit=-1, preferably in a way applications can't override, such as php_admin_value in the FPM
- Set a low post_max_size. For applications that don't require file uploads, set post_max_size = 8M.
- Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable allocation failure.

New.

Palo Alto: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products https://security.paloaltonetworks.com/CVE-2026-109618 #infosec #PHP #vulnerability

@mttaggart

Notable PHP Enjoyer Palo Alto has posted their advisory on #PHP2Shell:

https://security.paloaltonetworks.com/CVE-2026-109618

ALL versions of Panorama and PAN-OS are affected. There's a fix coming, but right now I recommend shutting down anything exposed publicly, like VPN portals.

Must-read blog post from the PHP foundation:

> [ In 2024 ] a PHP core developer contracted by the PHP Foundation found the first signs of the [out-of-memory] OOM problem behind CVE-2026-109618.

> the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#php2shell

Major Web Site Security Alert!

PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update immediately.

CISA POST:
"CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. " https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching #Security #CISA #PHP #CVE
#php2shell #SecurityPatch #SecurityAdvisory #Software #Risk #RemoteCodeExecution #RCE #WebSites #Internet #Web #WWW #CyberSecurity #CyberDefence

OK, sorted.

If you previously followed my example and ran #shotshare (https://www.bentasker.co.uk/posts/blog/general/deploying-shotshare-into-kubernetes.html) you're likely to be vulnerable to #php CVEs CVE-2026-109618 and CVE-2026-109619

Upstream looks to be abandoned, so I've forked and reworked the docker image to consume the fix (PR against upstream: https://github.com/mdshack/shotshare/pull/87)

In the meantime, I've pushed to my registries

* codeberg.org/bentasker/shotshare:202610-php-cve-bump
* bentasker12/shotshare:202610-php-cve-bump

Should be drop-in replacements

Claims of the PHP vulns being EITW:

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.

Here is what you need to know:

* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 

* The root is a decades-old design choice in PHP's error handling (described more in our post)

* There was evidence of in-the-wild exploitation pre-disclosure. 

The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application

We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.

What to do right now:

The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.

Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012. 

The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours. 

Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.

Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.

Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com

Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618

We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

#php2shell #php #CVE #eitw

New.

Google: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619 #Google #infosec #vulnerability #PHP

PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, two critical RCE flaws with reported exploitation. Widespread PHP use raises risk of mass compromise and outages, so prioritize patching and hunt for post-exploit activity. #PhpSecurity #RemoteCodeExecution #PatchNow

https://cyberworldops.eu/en/emergency-php-updates-address-two-critical-rce-flaws-amid-exploitation

PHP has released emergency fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical memory safety flaws in the PHP runtime that can allow unauthenticated code execution.

Upgrade now to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

🔗 https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619

What the PHP2Shell rumors got wrong, from inside the PHP security team https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

Palo finally published an advisory:

https://security.paloaltonetworks.com/CVE-2026-109618

No patch but some customers can get detections. Thanks, Palo. Fucking worthless fucks.

Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.

After publication of the vulnerability and patches, Advanced Threat Prevention (ATP) will release standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625), on Oct 21st.

The security risk posed by this issue on PAN-OS is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.

watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.

https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

#eitw #php #php2shell #CVE

"Plusieurs vulnérabilités critiques découvertes dans #PHP : installez immédiatement les mises à jour de sécurité"

"Deux vulnérabilités critiques dans PHP pourraient permettre à un attaquant d'exécuter du code malveillant sur les serveurs concernés sans avoir à s’authentifier. Des mises à jour de sécurité sont désormais disponibles. L'Office fédéral de la cybersécurité (OFCS) recommande de mettre à jour immédiatement les systèmes concernés. Outre les serveurs web, vérifiez également les applications et les appareils qui utilisent PHP comme composant intégré."
👇
https://www.bacs.admin.ch/fr/warnung-php-fr

🔍
👇
https://security-hub.ncsc.admin.ch/#/posts/13083

🇪🇺
👇
https://db.gcve.eu/vuln/CVE-2026-109618

#CyberVeille #PHP2shell

For those running pfSense+ (and possibly pfSense CE), it seems like PHP packages are starting to roll out:

https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619/15

#pfSense

Der Preis für die dümmste Teaser-Einleitung rund um CVE-2026-109618 und CVE-2026-109619 geht ganz klar an die #futurezone ....

»Es sollen die bisher schwerwiegendsten Sicherheitslücken sein, die je durch Künstliche Intelligenz aufgespürt wurden.«
https://futurezone.at/digital-life/php2shell-luecke-openai-google-70-prozent-des-internets/403199916

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the...

🔗️ [Securelist] https://link.is.it/nPWHOU

PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

Comments: https://news.ycombinator.com/item?id=50182987

#HackerNews #PHPFoundation #CVE2026 #SecurityUpdates #OpenSource #PHPSecurity

The path to happiness and posterity runs through PHP. Here is some of the research dealing with that today - so far.

KrebsonSecurity: Widespread PHP Flaw May Cause Many Site Outages Today https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/ @briankrebs

Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core

Cisco: Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ @TalosSecurity

CrowdStrike: Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/

Kaspersky: Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/ @Kaspersky

Sophos: Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 @SophosXOps

Palo Alto: Millions of PHP Instances Exposed - What Organizations Need To Do Right Now https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/

VulnCheck: PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 https://www.vulncheck.com/blog/php2shell-vulnerabilities @vulncheck

Socket: PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline https://socket.dev/blog/php-critical-rce-patches @SocketSecurity

Rapid7: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/ @Rapid7Official #vulnerability #threatresearch #infosec

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

#php #CISA #CVE

🚨 Rapid Response: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), can allow unauthenticated remote code execution across multiple PHP server configurations.

Censys ARC observes:
🔸 2,580,515 Internet-exposed hosts and 54,888,147 web properties running PHP
🔸 1,575,688 hosts reporting PHP versions older than the fixed releases

These figures do not represent confirmed vulnerable systems. Security fixes may be backported without changing reported version strings.

PHP has released security updates and recommends upgrading immediately.

Full advisory and Censys queries: https://censys.com/advisory/cve-2026-109618-cve-2026-109619/

#CensysARC #Cybersecurity #VulnerabilityManagement #PHP #InfoSec

PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.

If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.

Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

Нескучный октябрь.

> В целях снижения риска эксплуатации уязвимостей CVE-2026-109618 и
CVE-2026-109619 мы отключаем директиву session.upload_progress.enabled.
Некоторые функции сайтов, касающиеся индикации загрузки файлов станут недоступны.
> Патч безопасности затронет версии PHP выше 8.1, поэтому, по возможности, обновитесь до
последних версий PHP.
> Для версий ниже исправлений нет.

> Служба технической поддержки компании .masterhost

@Argyle13

Regarding PHP2shell (CVE-2026-109618 and CVE-2026-109619) vulnerability, you obviously need to patch as quickly as possible but Cloudflare has implemented some mitigation's in it's default firewall that might buy you some time. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Hey! Five alarm #infosec fire! Government websites across Europe have been taken offline following the discovery of two critical security vulnerabilities in PHP, a programming language that underpins a massive portion of the internet.

On October 21, 2026, PHP developers announced emergency patches fixing two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, giving hackers the ability to take control of servers.

PHP is pervasive. It serves as the underlying engine for major content management systems like #WordPress, #Drupal and #Joomla.

Cybersecurity teams globally are being urged to immediately isolate any vulnerable, internet-facing PHP servers until official emergency updates (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) can be manually deployed.

Cloudflare has implemented temporary firewall mitigation rules, but experts stress this is only a stopgap measure.

Go patch your #php. Now.

https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/

Auf Grund der schwerwiegenden PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 sind meine Websites aktuell und für mehrere Stunden nicht erreichbar.

PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and...

🔗️ [Bleepingcomputer] https://link.is.it/LMjG6I

Jesus Christ patch your shit now

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-109618/

Jesus Christ patch your shit n...

Jesus Christ patch your shit now

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-109618/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

@RensBloom I am also awaiting the update for Ubuntu. It got applied quickly (https://ubuntu.com/security/CVE-2026-109618#status) but now is the wait till all mirrors are updated I guess. Or manually add a repo which has the update.

PHP fixes two critical PHP RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing remote code execution. Update to 8.5.12 or 8.4.27.

#PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ModPHP #PatchNow #CyberSecurity

https://securityonline.info/php-rce-vulnerabilities-cve-2026-109618-109619/?utm_source=mastodon&utm_medium=jetpack_social

The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

The php2shell fix is out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Two critical bugs (CVSS 9.2), both remote code execution without authentication. mod_php has the highest risk, but PHP-FPM and other SAPIs are affected too. There are source backports for 7.4, 8.0 and 8.1.

Update, then do a full restart, not a reload.

Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

#PHP #InfoSec #CVE

🚨 Critical pre-authentication RCE research published for two PHP core vulnerabilities; CVE-2026-109618 + CVE-2026-109619

PoC: https://github.com/ikow/php2shell-poc

The flaws affect PHP's session.upload_progress handling and can be chained through session-file injection, memory corruption, or deserialization behavior to achieve remote code execution under specific application conditions.

CVSS: 9.2 Critical
Affected: PHP 5.4.0 through 8.5.11
Fixed: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12

The repository includes verification PoCs for session injection, a heap use-after-free, and handler-mismatch deserialization, along with a vulnerable Docker lab and detailed technical analysis.

📣 Announcing the immediate availability of:

- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12

‼️ These address the following critical security issues:

- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
:windows8: Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

Zwei kritische PHP-Lücken (CVE-2026-109618/109619, CVSS 9,2) ermöglichen unter bestimmten Bedingungen die Ausführung von Schadcode auf Webservern.

Dringend patchen! Für PHP 8.4 ist Version 8.4.27 erforderlich. Unter Debian 13 sind die Updates bereits verfügbar:

apt update && apt upgrade

Anschließend PHP-FPM neu starten:

systemctl restart php8.4-fpm

Auch andere Distributionen sollten jetzt aktualisiert werden!

https://www.php.net/archive/2026.php

#PHP #ITSecurity

#php2shell landed:

https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Wheeeeeeeee!

Unser Provider empfiehlt deutlich, die PHP-Seiten per Firewall/deny all komplett offline zu nehmen… bin gespannt, was um 16h00 disclosed wird (scheint ja in Richtung multiform upload handler zu gehen) #PHP #CVE-2026-109618 #CVE-2026-109619

PHP InfoSec

Wise system administrators who have caught wind of this bug have taken measures already

It hasn't been patched yet but you can mitigate exposure of your systems.
Better yet, do what is written on tweakers.net

Quotes:

Make your store read-only or take it offline

If you can afford to take a PHP server offline for a day, do so. PHP core developer Gina Peter Banyard calls that the most sensible option. Several Dutch sites went offline as a precaution on October 21: tech site Tweakers, the House of Representatives (Tweede Kamer), the National Cyber Security Centre (NCSC) and security news site Security.NL.

Stop PHP-FPM and have your web server show a static maintenance page. The maintenance modes built into Magento and WordPress do not help: PHP still parses each request before the application checks for the maintenance flag.

If you cannot go offline, make the store read-only. Have your web server reject every request method other than GET and HEAD, for example in nginx:

if ($request_method !~ ^(GET|HEAD)$) {
return 503;
}

Quote:

Websites overnemen

De twee kritieke kwetsbaarheden in PHP (CVE-2026-109618 en CVE-2026-109619) hebben een score van 9,2 op de CVSS v4.0-schaal, die tot 10 gaat. Dat hoge cijfer is gebaseerd op de ernst van een kwetsbaarheid en op hoe makkelijk aanvallers die kunnen misbruiken. De kwetsbaarheden zouden al sinds versie 5.4.0 in PHP zitten, die in maart 2012 uitkwam. Aanvallers kunnen door de kwetsbaarheden eigen webpagina's publiceren. Daardoor kunnen zij mogelijk malware verspreiden. Daarnaast zou de zogeheten PHP2Shell-exploit het mogelijk maken om eigen code uit te voeren op kwetsbare servers.

Volgens verschillende beveiligingsadviezen kan het helpen om session.upload_progress.enabled uit te schakelen. Een bijbehorende tijdelijke oplossing zou zijn om session.use_strict_mode in te schakelen. Beveiligingsexpert Kevin Beaumont meldt dat de Linux-kernelbeveiligingsmodule AppArmor of SELinux ook bescherming biedt tegen misbruik van deze grote PHP-kwetsbaarheden.

I understand the NL language
Translate this if you don't

Jump to the sources read and work

Sources:

https://jackalsyn.com/posts/php-up-2026.html

https://sansec.io/research/php2shell

https://tweakers.net/

#PHP #bug #serious #infoSEC #programming #upgrade

🚨 If you run PHP (like most of the internet does), this one can’t wait: #PHP2Shell = 2 critical RCE flaws in PHP core leaked before the patch, with live attacks already reported.

Because CVE-2026-109618 & CVE-2026-109619 sit in PHP itself, every app on a vulnerable PHP version is exposed, no matter what runs on top.

That’s why we’re building detection in our Network Scanner + an exploit module in Sniper as you’re reading this. Stay tuned for the launch announcement!

What to do now:

Inventory every PHP install, including control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
Patch as soon as PHP’s release is out, then restart PHP-FPM or your web server
On PHP 8.1 or older? No fix is coming. Upgrade, or take those systems off the internet
Alert on PHP processes spawning shells, interpreters, or download tools

#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking

@thomasfuchs that's spooky. Remote-code execution 😬

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

> From what has been reported, the flaws are in how PHP processes file-upload requests. When a browser sends a form that contains a file, it uses a multipart/form-data request, which is a request body split into separate parts for each field and file. PHP reads and splits that body itself before your application code runs.

Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)
#CVE_2026_109618 #CVE_2026_109619
https://watchtowr.com/intelligence/php-cve-2026-109618-faq/

Critical PHP security vulnerabilities (CVE-2026-109618/-109619)

Our entire team is working on assessing the impact of the disclosed vulnerabilities and preparing to deploy the PHP patch, which is due to be released today at 4 pm.

Due to maintenance work, there may be some service interruptions. We apologise for any inconvenience caused.

Do you run your own systems using PHP? Please carry out the update to the new version as a matter of urgency today.

We will keep you informed.

Kritische PHP-Sicherheitslücken (CVE-2026-109618/-109619)

Unser gesamtes Team arbeitet an der Betroffenheitsanalyse der bekannt gewordenen Schwachstellen und bereitet das Einspielen des PHP-Patches vor, der heute um 16 Uhr erscheinen soll.

Aufgrund der Wartungsarbeiten kann es zu Unterbrechungen kommen. Wir bitten um Ihr Verständnis.

Betreiben Sie eigene Systeme mit PHP? Führen Sie heute dringend das Update auf die neue Version durch.

Wir halten Sie auf dem Laufenden.

@GossiTheDog Additional PoCs and write-ups, supposedly:

https://github.com/0x4148/CVE-2026-109618-php2shell-lab

https://github.com/syhunt/php2shell-protection

https://qideng.substack.com/p/php2shell-dissecting-phps-critical

🔧 Dočasně vypínáme podporu přes FreeScout (helpdesk.oscloud.cz) kvůli kritické chybě v PHP. Znovu ji zapneme po aplikování opravy.

⚠️ Kritická zranitelnost v PHP, co to znamená pro OSCloud

PHP tým oznámil dvě kritické chyby (CVE-2026-109618 a CVE-2026-109619, obě CVSS 9.2). Mohou umožnit spuštění cizího kódu na serveru bez přihlášení. Oprava vychází dnes v 16:00 SEČ/CEST. Podle hlášení bezpečnostních firem už probíhají první útoky.

Kterých služeb se to týká:
• Nextcloud, WordPress, Pixelfed, FreeScout, a další aplikace postavené na PHP
• LAMP weby zákazníků (Apache + PHP), včetně těch, kde zatím běží jen úvodní stránka

Kterých ne:
• Mastodon, Matrix, PeerTube, Gitea (PHP nepoužívají)
• Weby a úložiště na statických souborech (Surfer)

Co děláme:
• FreeScout jsme vypnuli
• Další PHP aplikace a LAMP weby budeme vypínat postupně a vždy o tom budeme informovat zde. Počítejte s tím, že dočasně vypneme i Nextcloud, a to do vydání a nasazení opravy
• Jakmile budou dostupné opravené verze aplikací, nasadíme je co nejdřív
• Před vypnutím a updaty děláme zálohy

Co to znamená pro vás:
• Podpora přes FreeScout je do opravy nedostupná
• Nextcloud, LAMP weby a další PHP služby mohou být dnes nedostupné
• Pokud by se při updatu něco pokazilo, vracíme se ze zálohy maximálně 12 hodin zpět

Opravu nelze řešit pluginy ani updatem WordPressu, musí přijít nové PHP v rámci aktualizace aplikace. Pokud provozujete vlastní PHP web mimo OSCloud, aktualizujte PHP hned, jak vyjde oprava.

Děkujeme za trpělivost. Stav budeme průběžně aktualizovat v tomto vlákně.

#OSCloud #PHP #Bezpečnost

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) https://isc.sans.edu/diary/33440

⚠️PHP2Shell: Kritische PHP-Lücken CVE-2026-109618/109619⚠️

Zwei kritische PHP-Sicherheitslücken („PHP2Shell“) wurden am 20. Oktober vor Ablauf der Sperrfrist öffentlich. Das PHP-Team hat die Patch-Veröffentlichung daraufhin vorgezogen. (16:00MEZ).

Betroffen ist praktisch jede PHP-Website: #WordPress, #WooCommerce, #Drupal, #Joomla, #Magento. Das geleakte Exploit-Tool nennt PHP ab 5.4.0; offizielle Fixes unterstüzen nur PHP 8.2 bis 8.5 .

#php #php2shell #kritischelücke #sicherheit

Milhões de servidores PHP expostos ao risco da falha PHP2Shell. A recente divulgação de detalhes técnicos sobre as vulnerabilidades críticas no PHP (CVE-2026-109618 e CVE-2026-109619) acendeu os alertas no setor. 🚨

🔗 https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell

#apache #dados #equipa #falha #risco 

Die zentralen Websites der Uni Freiburg sind vom Netz genommen worden. #PHP

https://rz.uni-freiburg.de/de/rz/aktuell/stoerungen/2026-10-21-10-39-massnahme-im-zusammenhang-mit-der-kritischen-schwachstelle-php-cve-2026-109618-und-cve-2026-109619

php2shell: Dissecting PHP's Critical Session Upload Progress Vulnerabilities

CVE-2026-109618 & CVE-2026-109619 — From source code audit to three independent RCE chains

🔗️ [Substack] https://link.is.it/lp3FMf

CVE-2026-109618 & CVE-2026-109619: CRITICAL RCE in PHP (>=5.0.0). Patch lands Oct 21; only PHP 8.x supported. Mass exploitation likely post-release. Prepare to patch ASAP. Details: https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c #OffSeq #PHP #vuln #RCE

Another PoC for CVE-2026-109618/109619 PHP session.upload_progress https://github.com/ikow/php2shell-poc

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress

Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.

🔗️ [Huntress] https://link.is.it/Q3tPnD

🚨 Critical Alert from Karen IT
Two critical unauthenticated RCE vulnerabilities in PHP (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) have leaked early.

https://ksrc.karenit.net/blog/security-alert/urgent-php-remote-code-execution-vulnerabilities-(cve-2026-109618-&-cve-2026-109619)

Do not delay.

#PHP #RCE #CVE #CyberSecurity

🚨 تنبيه حرج
ثغرتان حرجتان في PHP تسمحان بتنفيذ أكواد عن بُعد بدون مصادقة (CVE-2026-109618 و CVE-2026-109619، CVSS 9.2) تم تسريبهما مبكراً.
لا تتأخروا.

#PHP #ثغرات #أمن_سيبراني

PHP : deux failles critiques ont fuité avant l’heure, un correctif d’urgence arrive ce 21 octobre ! https://www.it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #PHP

#php2shell
Ok, dann werden wir mal unsere Server absichern, bis es entsprechende gepatchte Versionen von PHP gibt
Im Artikel sind entsprechende Maßnahmen gut beschrieben und erklärt, und auch, was nicht funktioniert.

Da ältere Versionen als #PHP82 keine Patches erhalten werden, muss ich diese wohl eben manuell absichern. (ja, ich nutze auch noch ältere Versionen)

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

#devadmin #serveradmin #cve #php #phpsecurity #phppatch #security

>当該脆弱性を悪用できると主張するコードが、既にインターネット上に出回り始めています（2026/10/21 14時 日本時間 追記）。

PHPの重大な脆弱性「php2shell」（CVE-2026...

Upcoming critical PHP security release (CVE-2026-109618 / -109619): https://news-web.php.net/php.announce/509

Discussion: http://news.ycombinator.com/item?id=50172041

Hade tänkt ha en lugn onsdag med höstpromenad, gotta ned sig i programmeringsproblem och galamiddag på kvällen. Och så...

CVE-2026-109618 / -109619!!!

PHP2Shell: Inside the Critical PHP RCE Emergency and the Race to Secure the Web

https://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/

@gunchleoc @GossiTheDog
Thanks, I updated my blog post mentioning heise and https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

I will not link to sources and you don't have to trust me, but there are already exploits out there, one of them will get you a shell on servers running WordPress. So this is a critical update. CVE-2026-109618 and CVE-2026-109619 seem to affect all PHP versions going back to 5.4 and could result in RCE (Remote Code Execution).

#SysAdminLife @homelab

@pulsar Thanks!

TL;DR: Details of two critical holes in PHP leaked before a fix was ready. They’re in how PHP handles file uploads and could let attackers run their own code on your server. Possibly affects PHP 5 through 8. Fixes are due today at 14:00 UTC, and attacks are expected within minutes of release.

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

The bug sits below WordPress or Laravel, so having no upload form doesn’t protect you, and nor do security plugins or maintenance mode.

Until the patch: list every server running PHP, including old staging sites. Switch off PHP’s upload-progress setting, and get your web server to refuse upload-style requests before they reach PHP. That breaks uploads for a few hours, which is the trade-off.

Once the fix lands: update every PHP version on every server, restart PHP and any background workers, and rebuild Docker images. PHP 8.1 and older won’t get a fix, so upgrade or take them offline. On managed hosting, ask your host to confirm.

PHP Issues Emergency Warning for Critical Remote Code Execution Vulnerabilities

PHP is releasing emergency patches for two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). The release follows a data leak that forced the development team to move the disclosure date earlier to limit exploitation.

**If you run any website or app built on PHP (WordPress, online shops, internal tools), install the emergency security updates as soon as they're released today at 14:00 UTC. Until you've patched, restrict access to internal PHP systems and admin pages to trusted networks only, and monitor your servers closely for unusual logins, new files or strange activity.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/php-issues-emergency-warning-for-critical-remote-code-execution-vulnerabilities-y-t-1-8-c/gD2P6Ple2L

Upcoming critical PHP security release (CVE-2026-109618 / -109619)
Link: https://news-web.php.net/php.announce/509
Comments: https://news.ycombinator.com/item?id=50172041

looks like some PHP RCE (CVE-2026-109618 / CVE-2026-109619 / PHP-UP-2026) deets started to drop.

as a LAMP shared webhoster we're obviously Very Excited™

https://jackalsyn.com/posts/php-up-2026.html

Upcoming critical PHP security release (CVE-2026-109618 / -109619)

Link: https://news-web.php.net/php.announce/509
Discussion: https://news.ycombinator.com/item?id=50172041

PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)
https://news.ycombinator.com/item?id=50176077

#hackernews #tech

php2shell、影響範囲が広すぎてLog4Shell以来、あるいはそれ以上の騒ぎになってる

/ PHPの重大な脆弱性「php2shell」（CVE-2026-109618、CVE-2026-109619）の概要と対応指針 - GMO Flatt Security Blog https://blog.flatt.tech/entry/php2shell

@falken There are CVEs now, but no patches expected till 14:00 UTC, and at least one proof-of-concept exploit actively circulating.

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)

Link: https://jackalsyn.com/posts/php-up-2026.html
Discussion: https://news.ycombinator.com/item?id=50176077

🚨 There is a critical flaw in PHP that leads to remote code execution. A patch is has not been released yet.

If you run DokuWiki or any other PHP software, I would recommend shutting down the webserver until official mitigation steps and/or a patch is available.

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

The PHP team issued an urgent advisory for critical PHP vulnerabilities CVE-2026-109618 and 109619, threatening millions of exposed web servers.

#PHP #Cybersecurity #Vulnerability #Infosec #PatchTuesday

https://meterpreter.org/critical-php-vulnerabilities-emergency-patch/?utm_source=mastodon&utm_medium=jetpack_social

in php.ini:
 session.upload_progress.enabled = Off
 session.use_strict_mode = 1

mitigates the current public PoCs that may or may not be for CVE-2026-109618 / CVE-2026-109619

whether this is a true mitigation or AI hallucination I don't actually know

christ, there are apparently public PoCs for CVE-2026-109618 and CVE-2026-109619

PHP's notice names no bug type, CVE IDs or affected versions for two critical flaws (CVSS v4.0 9.2 each) due to be fixed Oct 21 at 14:00 UTC, sooner if details go public. A leak says RCE, CVE-2026-109618 and CVE-2026-109619, PHP 5 onward. watchTowr, a security testing vendor, says it confirmed the leak, but its FAQ calls the scope unverified. PHP supports only 8.2 to 8.5.

https://news-web.php.net/php.announce/509

#PHP #InfoSec #Cybersecurity

Upcoming critical PHP security release (CVE-2026-109618 / -109619)

https://news-web.php.net/php.announce/509

#security

🏆 New Achievement! Embargo This, Actually!

Your Q4 infrastructure review is in, and the numbers look great — uptime solid, tickets closed, coffee budget approved. One small note in the "Areas for Improvement" column: somebody leaked two critical PHP 8 zero-days rated CVSS 9.2 a full day before the embargo lifted, forcing the PHP security team to rush an emergency release to October 21 at 14:00 UTC. CVE-2026-109618 and CVE-2026-109619 are remote code execution flaws in PHP core. (1/2)

A PHP security release on Oct 21 fixes two CVSS 9.2 flaws, CVE-2026-109618 and CVE-2026-109619, leaked as remote code execution bugs.

#PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ZeroDay #PatchNow #CyberSecurity

https://securityonline.info/php-security-release-cve-2026-109618-109619/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-93442 - High (8.2)

IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93442/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The Chrome 156 security update fixes 353 flaws, including six critical vulnerabilities such as CVE-2026-113341. Update to 156.0.8078.47.

#Chrome #GoogleChrome #Chrome156 #CVE2026113341 #CVE2026113271 #CVE2026113303 #BrowserSecurity #CyberSecurity

https://securityonline.info/chrome-156-security-update/?utm_source=mastodon&utm_medium=jetpack_social

ISC fixes four BIND 9 vulnerabilities, including CVE-2026-94300 memory corruption and denial of service bugs. Upgrade to BIND 9.20.30 or 9.21.27.

#BIND9 #ISC #DNS #CVE202694300 #CVE202619630 #CVE202697313 #DenialOfService #CyberSecurity

https://securityonline.info/bind-9-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

ISC fixes four BIND 9 vulnerabilities, including CVE-2026-94300 memory corruption and denial of service bugs. Upgrade to BIND 9.20.30 or 9.21.27.

#BIND9 #ISC #DNS #CVE202694300 #CVE202619630 #CVE202697313 #DenialOfService #CyberSecurity

https://securityonline.info/bind-9-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-114403: PHPOffice PHPPresentation ≤1.2.0 faces CRITICAL insecure deserialization (CVSS 9.2). Remote code execution & DoS possible via crafted uploads. No patch; avoid untrusted inputs. Details: https://radar.offseq.com/threat/cve-2026-114403-deserialization-of-untrusted-data-in-phpoffice-phppresentation-21b2eb9e24a6b900 #OffSeq #CVE2026114403 #PHP #AppSec

CVE-2026-87095: A CRITICAL auth bypass in Acronis Cyber Infrastructure (pre-6.0.1-112/6.1.1-64/6.2.1-71) risks data disclosure & tampering (CVSS 9.1). No patch confirmed. Limit network access & monitor logs. https://radar.offseq.com/threat/cve-2026-87095-cwe-863-in-acronis-acronis-cyber-infrastructure-10e3c7d3d7e8e2e5 #OffSeq #CVE #Acronis #Vuln #BlueTeam

SANS Stormcast Wednesday, October 21st, 2026: eMudhra Intermediate CA Certificates Revoked; Critical PHP Security Release; Oracle CPU E-Business Suite SQLi (CVE-2026-101767); FortiSIEM gRPC RCE PoC
https://isc.sans.edu/podcastdetail/10144

New advisory from Fortinet for a medium-severity bug:

CVE-2025-66178: FortiWeb improper neutralization of special elements used in an OS command vulnerability https://app.opencve.io/cve/CVE-2025-66178

Yesterday:

CRITICAL: CVE-2026-106173: improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 https://app.opencve.io/cve/CVE-2026-106173 #Fortinet #infosec #vulnerability

New advisory from Fortinet for a medium-severity bug:

CVE-2025-66178: FortiWeb improper neutralization of special elements used in an OS command vulnerability https://app.opencve.io/cve/CVE-2025-66178

Yesterday:

CRITICAL: CVE-2026-106173: improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 https://app.opencve.io/cve/CVE-2026-106173 #Fortinet #infosec #vulnerability

CVE-2026-71195 (CRITICAL, CVSS 9.9) impacts OpenStack Manila <23.0.1: incorrect authorization lets any authenticated user manipulate public shares’ access, data, and metadata. Patch immediately. https://radar.offseq.com/threat/cve-2026-71195-cwe-863-incorrect-authorization-in-openstack-manila-18015d0d3bd42f24 #OffSeq #OpenStack #Vuln #Infosec

🚨 Security update: Unbound 1.26.2 is now available.

This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.

https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495

#DNS #OpenSource #Security #CVE

🚨 Security update: Unbound 1.26.2 is now available.

This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.

https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495

#DNS #OpenSource #Security #CVE

🚨 Security update: Unbound 1.26.2 is now available.

This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.

https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495

#DNS #OpenSource #Security #CVE

🚨 Security update: Unbound 1.26.2 is now available.

This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.

https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495

#DNS #OpenSource #Security #CVE

🚨 Security update: Unbound 1.26.2 is now available.

This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.

https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495

#DNS #OpenSource #Security #CVE

New advisory from Fortinet for a medium-severity bug:

CVE-2025-66178: FortiWeb improper neutralization of special elements used in an OS command vulnerability https://app.opencve.io/cve/CVE-2025-66178

Yesterday:

CRITICAL: CVE-2026-106173: improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 https://app.opencve.io/cve/CVE-2026-106173 #Fortinet #infosec #vulnerability

New advisory from Fortinet for a medium-severity bug:

CVE-2025-66178: FortiWeb improper neutralization of special elements used in an OS command vulnerability https://app.opencve.io/cve/CVE-2025-66178

Yesterday:

CRITICAL: CVE-2026-106173: improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 https://app.opencve.io/cve/CVE-2026-106173 #Fortinet #infosec #vulnerability

🏆 New Achievement! gRPC Reaper Has Entered the Room!

A shadow falls across your server rack. The torches flicker. The orchestral stabs begin. Ladies and gentlemen — CVE-2026-106173 has arrived. Fortinet's FortiSIEM harbors a critical path traversal flaw in its gRPC service, and this boss doesn't knock: unauthenticated attackers can overwrite system scripts and achieve full remote code execution. No credentials required. (1/3)

Critical FortiSIEM gRPC Flaw Allows Unauthenticated Remote Code Execution

Fortinet patched a critical path traversal vulnerability (CVE-2026-106173) in FortiSIEM that allows unauthenticated attackers to achieve remote code execution by overwriting system scripts via a gRPC service.

**If you run FortiSIEM on-premise (versions 7.0 through 7.5.0), upgrade to 7.5.1 or later right away. A working exploit is already public, so treat this as an emergency. Until you can patch, block TCP port 27918 for everything except trusted management networks, and check whether `/opt/charting/redishb.sh` or `/opt/phoenix/bin/phLicenseTool` has been modified.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-fortisiem-grpc-flaw-allows-unauthenticated-remote-code-execution-b-w-l-1-m/gD2P6Ple2L

CRITICAL: CVE-2026-113744 impacts Tenda AC19 (v16.03.10.07) via stack-based buffer overflow in /goform/SetFirewallCfg. Remote, unauthenticated code execution possible. Public exploit code available. Restrict web access. https://radar.offseq.com/threat/cve-2026-113744-stack-based-buffer-overflow-in-tenda-ac19-5bc63cbf73d618d2 #OffSeq #CVE2026113744 #Infosec

CVE-2026-114119: CRITICAL in Bp Premier <1.14.1.1128 — hardcoded SQL admin password lets attackers with DB access gain SYSTEM privileges. Restrict access, monitor activity, check vendor guidance. https://radar.offseq.com/threat/cve-2026-114119-use-of-hard-coded-credentials-in-best-practice-software-bp-premier-982d2cc31766a5fd #OffSeq #infosec #CVE2026114119

CVE-2026-114108: CRITICAL vuln in HKUDS Vibe-Trading ≤0.1.6 – missing auth enables root shell commands, script uploads, session leaks. Set API_AUTH_KEY & restrict API access now. Patch unconfirmed. https://radar.offseq.com/threat/cve-2026-114108-missing-authentication-for-critical-function-in-hkuds-vibe-trading-dbf2add5e4f70bbe #OffSeq #vulnerability #infosec #HKUDS

MariaDB critical vulnerabilities, including CVE-2026-92262 (CVSS 9.9), risk remote code execution. Upgrade to the October 2026 releases.

#MariaDB #MySQL #CVE202692262 #CVE202685746 #CVE202685748 #RemoteCodeExecution #DatabaseSecurity #CyberSecurity

https://securityonline.info/mariadb-critical-vulnerabilities-rce/?utm_source=mastodon&utm_medium=jetpack_social

🚨 JUST IN: Announcing rustup 1.29.2

> Rustup 1.29.2 is a small security release that updates dependencies to fix the eMudhra intermediate certificate issue (CVE-2026-111943). Update with rustup self update.

@nerdpr0f @kajer https://www.cve.org/CVERecord?id=CVE-2026-114083

🟠 CVE-2026-93888 - High (7.8)

IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93888/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

A CVSS 10.0 E-Business Suite vulnerability, CVE-2026-101809, lets unauthenticated attackers take over Workflow. Oracle fixed 194 EBS flaws.

#Oracle #EBusinessSuite #CVE2026101809 #CVE2026101767 #PatchNow

https://securityonline.info/oracle-e-business-suite-vulnerability-cve-2026-101809/?utm_source=mastodon&utm_medium=jetpack_social

Oracle Critical Patch Update for October 2026 fixes 1,209 CVEs, including six CVSS 10.0 bugs such as CVE-2026-101809 in E-Business Suite.

#Oracle #CriticalPatchUpdate #CVE2026101809 #WebLogic #PatchNow

https://securityonline.info/oracle-critical-patch-update-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-91658 - Critical (9.9)

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91658/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Oracle Fusion Middleware vulnerabilities include four CVSS 10.0 bugs such as CVE-2026-87337 in Access Manager and SOA Suite takeover flaws.

#Oracle #FusionMiddleware #WebLogic #CVE202687337 #SOASuite

https://securityonline.info/oracle-fusion-middleware-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

@kajer @nerdpr0f https://nvd.nist.gov/vuln/detail/cve-2026-9827

CVE-2026-28763: CRITICAL stack buffer overflow in TOTOLINK X2000R (V1.0.0-B20250421.1327). Authenticated attacker can trigger code execution via crafted HTTP request. Restrict HTTP access pending patch. https://radar.offseq.com/threat/a-stack-based-buffer-overflow-vulnerability-exists-in-the-boa-formmapdeldevice-hostname-functionality-af3e5fb680816baa #OffSeq #Vulnerability #IoTSecurity #CVE

Six Apache CouchDB vulnerabilities, including CVSS 9.3 CVE-2026-86471, are fixed in 3.5.3. Retired Apache Cocoon gets four unpatched flaws.

#ApacheCouchDB #ApacheCocoon #CVE202686471 #CVE202690800 #CVE2026108089 #CommandInjection #DatabaseSecurity #CyberSecurity

https://securityonline.info/apache-couchdb-vulnerabilities-cocoon/?utm_source=mastodon&utm_medium=jetpack_social

Signal Flaw Leaves Mics, Cameras Active After Call Hangup

Beware of what you say after hanging up a call on Signal - a critical bug in the app's calling library can leave your mic and camera active, potentially exposing sensitive conversations. This shocking security flaw, tracked as CVE-2026-113380, affects all Signal versions before 2.72.0.

https://osintsights.com/signal-flaw-leaves-mics-cameras-active-after-call-hangup?utm_source=mastodon&utm_medium=social

#SignalFlaw #Cve2026113380 #Ringrtc #Webrtc #VoipSecurity

Signal fixed critical RingRTC flaw CVE-2026-113380, which could leave audio—and possibly video—active after hangup. The fix is in RingRTC 2.72.0; Signal users should update their apps. 🔒📞 #Signal #Cybersecurity https://cyberinsider.com/signal-fixes-critical-flaw-that-could-keep-audio-active-after-hangup/

30 Advantech ADAM-3600 vulnerabilities, including CVE-2026-43836, allow remote code execution and auth bypass. Update EdgeLink to 2.8.5.0.

#Advantech #ADAM3600 #ICS #OTSecurity #CVE202643836 #CVE202643844 #RemoteCodeExecution #CyberSecurity

https://securityonline.info/advantech-adam-3600-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

@douglasvb @fname Don't lose track of CVE-2026-99999 either 🫠

@douglasvb @fname Don't lose track of CVE-2026-99999 either 🫠

🚨 PwnEscape (CVE-2026-99999), a critical Linux kernel flaw, could let malicious VMs escape KVM isolation and compromise hosts. Admins should patch and plan for a reboot; researchers warn exploits may emerge within weeks. 🔒 #Linux #Cybersecurity https://www.heise.de/en/news/PwnEscape-Critical-Linux-kernel-flaw-allows-VM-escape-11492399.html

@gettie my cybersecurity tool of choice is running fucking Solaris. CVE-2026-99999 doesn't do shit on Solaris lol

@mcc CVE-2026-99999 is also known as PwnEscape, a very real vuln that enables KVM guest to host escape. https://heise.de/-11492399
I wonder if MITRE is going to sell vanity CVEs at some point in the future.

@schenklklopfer

Ohne Anspruch auf Vollständigkeit:
- CVE-2026-99999
- Intermediate CAs mit dem Private Key "4"
- Heute Nachmittag kommen die Fixes für php2shell
- Ich warte seit fast nem Monat darauf, dass ein Hersteller einer einigermaßen verbreiteten Software endlich die unzähligen Dependencies mit bekannten Sicherheutslücken updatet. Dazu muss man eigentlich nur Versionsnummern in ein paar Buildscripten ändern, aber tut er halt nicht. Stattdessen nur Tumbleweed und Crickets von KI-Bots.

@azonenberg @peterbjornx VM escape: https://socprime.com/blog/cve-2026-99999-analysis/

@mcc

Ubuntu says it does?

https://ubuntu.com/security/CVE-2026-99999

OK before I go to bed anyone wanna warn me that CVE-2026-99999 impacts Ubuntu after all

"CVE-2026-99999" is the fakest sounding CVE name. That is like Hideo Kojima or Kotaro Uchikoshi had just learned what a "CVE" is and decided to write a plot point about a macguffin mega-CVE that is going to cause enormous problems for the protagonists

Your NGINX installation may already be a smoldering crater — but the good news is F5 has heroically issued out-of-band patches, which is vendor-speak for "we skipped the normal schedule because yikes." Three critical flaws across ngx_http_v3_module and the NGINX map directive — CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479 — let unauthenticated remote attackers trigger heap buffer overflows, run arbitrary code, or knock your server flat. (2/4)

Your NGINX installation may already be a smoldering crater — but the good news is F5 has heroically issued out-of-band patches, which is vendor-speak for "we skipped the normal schedule because yikes." Three critical flaws across ngx_http_v3_module and the NGINX map directive — CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479 — let unauthenticated remote attackers trigger heap buffer overflows, run arbitrary code, or knock your server flat. (2/4)

Your NGINX installation may already be a smoldering crater — but the good news is F5 has heroically issued out-of-band patches, which is vendor-speak for "we skipped the normal schedule because yikes." Three critical flaws across ngx_http_v3_module and the NGINX map directive — CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479 — let unauthenticated remote attackers trigger heap buffer overflows, run arbitrary code, or knock your server flat. (2/4)

CVE-2026-94041 SQL injection in Restaurant Management System admin/add_menu.php, CVSS 6.3, public exploit out and still unpatched. Check your deployment and patch now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94041/

CVE-2026-92400 WooCommerce PayPal plugin flaw lets unauthenticated users mark orders paid via sandbox transactions. CVSS 5.3, no patch confirmed. Update to 9.2.1 now. #CVE #infosec #WooCommerce https://www.valtersit.com/cve/CVE-2026-92400/

CVE-2026-94103: code injection via eval in RooCMS frontend rendering, up to 1.4RC2. CVSS 4.7, public exploit, no vendor response or patch. Restrict access and review your install now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94103/

Matrix über die PHP-Releases:

https://ma.ttias.be/php-cve-2026-109618-patch/#package-status

#nextcloud #php

What the PHP2Shell rumors got wrong, from inside the PHP security team

PHP 보안팀 관점에서 PHP2Shell 루머와 실제 취약점(CVE-2026-109618, CVE-2026-109619)을 대조하며, 핵심 RCE는 기본 설정의 Apache mod_php에서 애플리케이션 코드 실행 전 원격으로 트리거될 수 있다고 설명합니다. 주된 원인은 memory_limit 초과 시 Zend allocator가 longjmp로 요청 초기화 중인 C 코드의 실행을 중단하고, 미완성 상태의 요청 구조체가 shutdown 단계에서 사용되며 발생하는 메모리 손상입니다. 패치된 PHP 8.2.35·8.3.36·8.4.27·8.5.12는 a...

https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

What the PHP2Shell rumors got wrong, from inside the PHP security team https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

What the PHP2Shell rumors got wrong, from inside the PHP security team https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

@mcc https://nvd.nist.gov/vuln/detail/cve-2025-69420

🚨 EUVD-2026-107242

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: trudesk
🏢 Vendor: polonel
📅 Updated: 2026-10-21

📝 Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /a...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107242

#cybersecurity #infosec #euvd #cve #vulnerability