TOTOLINK A950RG 4.1.2cu.5268_B20221104 faces CRITICAL CVE-2026-114575 (CVSS 10) — remote command injection via UploadCustomModule. Exploit is public. Patch or isolate devices. https://radar.offseq.com/threat/cve-2026-114575-command-injection-in-totolink-a950rg-4953ac46344cdab5 #OffSeq #CVE #IoTSecurity #RouterSecurity

TOTOLINK A950RG 4.1.2cu.5268_B20221104 faces CRITICAL CVE-2026-114575 (CVSS 10) — remote command injection via UploadCustomModule. Exploit is public. Patch or isolate devices. https://radar.offseq.com/threat/cve-2026-114575-command-injection-in-totolink-a950rg-4953ac46344cdab5 #OffSeq #CVE #IoTSecurity #RouterSecurity

Apply the GitLab critical patch release to fix 12 GitLab vulnerabilities, including 10.0 CVSS RCE flaw CVE-2026-110264 and CVE-2026-15723.

#GitLab #CVE2026110264 #DevSecOps #RCE #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/gitlab-critical-patch-release-cve-2026-110264/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-114730: SSRF in Roundcube Webmail (HIGH, CVSS 7.2) affects 1.6.14-1.6.19 & 1.7.0-1.7.4. NAT64 filter bypass allows internal requests. Update to 1.6.20/1.7.5 now. https://radar.offseq.com/threat/cve-2026-114730-cwe-918-server-side-request-forgery-ssrf-in-roundcube-webmail-151b1341ca143178 #OffSeq #Security #Roundcube #SSRF

CVE-2026-114730: SSRF in Roundcube Webmail (HIGH, CVSS 7.2) affects 1.6.14-1.6.19 & 1.7.0-1.7.4. NAT64 filter bypass allows internal requests. Update to 1.6.20/1.7.5 now. https://radar.offseq.com/threat/cve-2026-114730-cwe-918-server-side-request-forgery-ssrf-in-roundcube-webmail-151b1341ca143178 #OffSeq #Security #Roundcube #SSRF

CVE-2026-114727 (HIGH): Roundcube Webmail <1.6.20/1.7.5 allows SVG/EPS uploads, risking remote code execution via ImageMagick. Upgrade to 1.6.20+ or 1.7.5+ to mitigate. Details: https://radar.offseq.com/threat/cve-2026-114727-cwe-829-inclusion-of-functionality-from-untrusted-control-sphere-in-roundcube-webmail-0e067a7fe4b46d68 #OffSeq #Vulnerability #Infosec #Roundcube

CVE-2026-114727 (HIGH): Roundcube Webmail <1.6.20/1.7.5 allows SVG/EPS uploads, risking remote code execution via ImageMagick. Upgrade to 1.6.20+ or 1.7.5+ to mitigate. Details: https://radar.offseq.com/threat/cve-2026-114727-cwe-829-inclusion-of-functionality-from-untrusted-control-sphere-in-roundcube-webmail-0e067a7fe4b46d68 #OffSeq #Vulnerability #Infosec #Roundcube

GitLab says CVE-2026-110264 (CVSS 10.0) could let an unauthenticated attacker run code on self-managed servers, in all versions since 7.0. It is GitLab's second CVSS 10.0 regex integer overflow in nine days: instances patched on Oct 12 (19.4.2, 19.3.5, 19.2.8) remain exposed until 19.5.1, 19.4.3, 19.3.6 or a 19.2.9 backport. GitLab lists no workaround and says GitLab.com and Dedicated were already patched.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

#GitLab #InfoSec #Cybersecurity #SelfHosted

📢 [VULN] ⚠️Faille critique GitLab CVE-2026-110264 (CVSS 10) : correctifs

Le 21 octobre 2026, GitLab corrige CVE-2026-110264, une exécution de code à distance sans authentification notée 10.0 qui touche toutes les versions de GitLab CE et EE depuis la 7.0, y compris les instances mises à jour le 12 octobre. L'éditeur ne propose aucun contournement.

🔗 https://loud-technology.com/insight/faille-critique-gitlab-cve-2026-110264/
💬 discussion : https://infosec.pub/post/53915526
#CVE #Cyberveille

GitLab Critical Patch Release

GitLab이 CE/EE 전반에 영향을 주는 긴급 패치 릴리스를 배포했으며, 핵심 취약점 CVE-2026-110264는 조작된 정규식을 통한 정수 오버플로로 인증 없이 GitLab 서버에서 임의 코드 실행이 가능한 CVSS 10.0 RCE다. 영향을 받는 자체 관리형 인스턴스는 즉시 19.5.1, 19.4.3, 19.3.6 또는 지원되는 하위 릴리스(19.2.9/19.1.9/19.0.10/18.11.13)로 업그레이드해야 한다. 함께 수정된 항목에는 OmniAuth-SAML과 LDAP 자동 연결 조합에서의 계정 탈취(CVSS 8.2), OAuth/OIDC 디스커버리 캐시 오염(CVSS...

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

If you run GitLab, you've handled some bad vulns recently, so what's one more? Perfect 10 patched today.

https://ifin.network/t/cve-2026-110264-integer-overflow-in-gitlab-regex-compiler/920

#ThreatIntel #ThreatIntelligence #IFIN

GitLab says CVE-2026-110264 (CVSS 10.0) could let an unauthenticated attacker run code on self-managed servers, in all versions since 7.0. It is GitLab's second CVSS 10.0 regex integer overflow in nine days: instances patched on Oct 12 (19.4.2, 19.3.5, 19.2.8) remain exposed until 19.5.1, 19.4.3, 19.3.6 or a 19.2.9 backport. GitLab lists no workaround and says GitLab.com and Dedicated were already patched.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

#GitLab #InfoSec #Cybersecurity #SelfHosted

If you run GitLab, you've handled some bad vulns recently, so what's one more? Perfect 10 patched today.

https://ifin.network/t/cve-2026-110264-integer-overflow-in-gitlab-regex-compiler/920

#ThreatIntel #ThreatIntelligence #IFIN

NOT NOW, GITLAB AND NODEJS.

CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler => RCE
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee

CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits RCE
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Apply the GitLab critical patch release to fix 12 GitLab vulnerabilities, including 10.0 CVSS RCE flaw CVE-2026-110264 and CVE-2026-15723.

#GitLab #CVE2026110264 #DevSecOps #RCE #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/gitlab-critical-patch-release-cve-2026-110264/?utm_source=mastodon&utm_medium=jetpack_social

@ifin Did you also catch the CVSS 10.0 from GitLab? https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee

Oh. My. Bob. It is a hella day to be in #infosec, I tell you what.

#Gitlab has a CVSS 10! and released critical patch updates on October 21, 2026, addressing multiple severe vulnerabilities including an unauthenticated Remote Code Execution (#RCE) flaw.

The patches cover GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.

The update fixes CVE-2026-110264, a CVSS 10.0 integer overflow in the regular expression compiler that allows unauthenticated code execution across all self-managed versions dating back to 7.0 (2014).

The release also remediated 10 additional security issues, including cache poisoning in OAuth/OIDC endpoints (told you it was problematic).

Administrators of self-managed GitLab instances are strongly advised to upgrade immediately, as GitLab.com and GitLab Dedicated tenants already have the fixes applied.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

Splunk fixes 31 Splunk vulnerabilities in Enterprise and Splunk SOAR, including CVSS 9.9 flaws CVE-2026-76531, CVE-2026-76299 and CVE-2026-76302.

#Splunk #SplunkSOAR #CVE202676531 #CVE202676299 #CVE202676302 #SIEM #PatchNow #CyberSecurity

https://securityonline.info/splunk-vulnerabilities-enterprise-soar-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Splunk fixes 31 Splunk vulnerabilities in Enterprise and Splunk SOAR, including CVSS 9.9 flaws CVE-2026-76531, CVE-2026-76299 and CVE-2026-76302.

#Splunk #SplunkSOAR #CVE202676531 #CVE202676299 #CVE202676302 #SIEM #PatchNow #CyberSecurity

https://securityonline.info/splunk-vulnerabilities-enterprise-soar-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Splunk fixes 31 Splunk vulnerabilities in Enterprise and Splunk SOAR, including CVSS 9.9 flaws CVE-2026-76531, CVE-2026-76299 and CVE-2026-76302.

#Splunk #SplunkSOAR #CVE202676531 #CVE202676299 #CVE202676302 #SIEM #PatchNow #CyberSecurity

https://securityonline.info/splunk-vulnerabilities-enterprise-soar-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Splunk fixes 31 Splunk vulnerabilities in Enterprise and Splunk SOAR, including CVSS 9.9 flaws CVE-2026-76531, CVE-2026-76299 and CVE-2026-76302.

#Splunk #SplunkSOAR #CVE202676531 #CVE202676299 #CVE202676302 #SIEM #PatchNow #CyberSecurity

https://securityonline.info/splunk-vulnerabilities-enterprise-soar-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Splunk fixes 31 Splunk vulnerabilities in Enterprise and Splunk SOAR, including CVSS 9.9 flaws CVE-2026-76531, CVE-2026-76299 and CVE-2026-76302.

#Splunk #SplunkSOAR #CVE202676531 #CVE202676299 #CVE202676302 #SIEM #PatchNow #CyberSecurity

https://securityonline.info/splunk-vulnerabilities-enterprise-soar-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Splunk fixes 31 Splunk vulnerabilities in Enterprise and Splunk SOAR, including CVSS 9.9 flaws CVE-2026-76531, CVE-2026-76299 and CVE-2026-76302.

#Splunk #SplunkSOAR #CVE202676531 #CVE202676299 #CVE202676302 #SIEM #PatchNow #CyberSecurity

https://securityonline.info/splunk-vulnerabilities-enterprise-soar-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Patch 13 Apache Pulsar vulnerabilities and 4 Apache IoTDB flaws now, including critical bugs CVE-2026-105944, CVE-2026-105869, and CVE-2026-59229.

#ApachePulsar #ApacheIoTDB #Apache #Cybersecurity #Vulnerability #CloudSecurity #InfoSec

https://securityonline.info/apache-pulsar-vulnerabilities-iotdb-patched/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-105944: 10.0

An unauthenticated attacker over the network can create additional administrator accounts and log in to #Apache Pulsar Manager, invoke arbitrary #Pulsar admin API operations

Patch 13 Apache Pulsar vulnerabilities and 4 Apache IoTDB flaws now, including critical bugs CVE-2026-105944, CVE-2026-105869, and CVE-2026-59229.

#ApachePulsar #ApacheIoTDB #Apache #Cybersecurity #Vulnerability #CloudSecurity #InfoSec

https://securityonline.info/apache-pulsar-vulnerabilities-iotdb-patched/?utm_source=mastodon&utm_medium=jetpack_social

Oracle Security Alert Advisory – CVE-2026-91403 (eMudhra cert revocation)

Oracle이 eMudhra 인증서 폐기와 관련된 JSSE 취약점 CVE-2026-91403용 긴급 보안 패치를 발표했다. 이 취약점은 네트워크를 통해 인증 없이 원격 악용될 수 있으며 CVSS 3.1 기준 9.1점으로, 기밀성과 무결성에 높은 영향을 준다. Oracle Java SE 8u511·11.0.33·17.0.21·21.0.13·25.0.5·27.0.1 및 GraalVM for JDK/Enterprise Edition의 특정 버전이 영향을 받는다. Java 기반 AI 서비스, 에이전트 백엔드, 빌드·추론 인프라에서 해당 런타...

https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

@leah You forgot Java

> This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs.

https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

@foone yo dawg I heard you like CVEs https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

@CursedSilicon @foone QUIC and node.js are news to me, details?

Anyway yes, you missed Java: https://www.cve.org/CVERecord?id=CVE-2026-91403

@leah You forgot Java

> This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs.

https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

@foone yo dawg I heard you like CVEs https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

@CursedSilicon @foone QUIC and node.js are news to me, details?

Anyway yes, you missed Java: https://www.cve.org/CVERecord?id=CVE-2026-91403

@wezm

- Java CVE-2026-91403

Oracle Security Alert Advisory – CVE-2026-91403 (eMudhra cert revocation)

https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

#security

sev:CRIT in Java really is the best way this week could continue on course.

https://www.cve.org/CVERecord?id=CVE-2026-91403

sev:CRIT 9.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Man, PHP has been getting its shit kicked in today. Well, at least the other language I grew up on is doing fine, right Java?

...Java?

oh. oh no.
https://www.cve.org/CVERecord?id=CVE-2026-91403

ENDLESS CVE WEDNESDAY PART FIVE BABYYYYYYYYYY THREE NEW PERFECT 10S IN APACHE TRAFFIC SERVER, THE RIDE NEVER ENDS

www.cve.org/CVERecord?id...
www.cve.org/CVERecord?id...
www.cve.org/CVERecord?id...

cve.org/CVERecord?id=C...

15 Apache Traffic Server vulnerabilities, including CVSS 10.0 CVE-2026-111813, allow cache poisoning and smuggling. Upgrade to 10.2.1.

#ApacheTrafficServer #ATS #CVE2026111813 #CVE2026111811 #CVE2026111816 #CachePoisoning #RequestSmuggling #CyberSecurity

https://securityonline.info/apache-traffic-server-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

15 Apache Traffic Server vulnerabilities, including CVSS 10.0 CVE-2026-111813, allow cache poisoning and smuggling. Upgrade to 10.2.1.

#ApacheTrafficServer #ATS #CVE2026111813 #CVE2026111811 #CVE2026111816 #CachePoisoning #RequestSmuggling #CyberSecurity

https://securityonline.info/apache-traffic-server-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-111813/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-111813/

"No way to prevent this" say u...

ENDLESS CVE WEDNESDAY PART FIVE BABYYYYYYYYYY THREE NEW PERFECT 10S IN APACHE TRAFFIC SERVER, THE RIDE NEVER ENDS

www.cve.org/CVERecord?id...
www.cve.org/CVERecord?id...
www.cve.org/CVERecord?id...

cve.org/CVERecord?id=C...

Patch 13 Apache Pulsar vulnerabilities and 4 Apache IoTDB flaws now, including critical bugs CVE-2026-105944, CVE-2026-105869, and CVE-2026-59229.

#ApachePulsar #ApacheIoTDB #Apache #Cybersecurity #Vulnerability #CloudSecurity #InfoSec

https://securityonline.info/apache-pulsar-vulnerabilities-iotdb-patched/?utm_source=mastodon&utm_medium=jetpack_social

Patch 13 Apache Pulsar vulnerabilities and 4 Apache IoTDB flaws now, including critical bugs CVE-2026-105944, CVE-2026-105869, and CVE-2026-59229.

#ApachePulsar #ApacheIoTDB #Apache #Cybersecurity #Vulnerability #CloudSecurity #InfoSec

https://securityonline.info/apache-pulsar-vulnerabilities-iotdb-patched/?utm_source=mastodon&utm_medium=jetpack_social

The PHP Foundation says first signs of the flaw behind CVE-2026-109618 appeared in 2024, and the fix then stalled for months: "a structural failure." PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix it and CVE-2026-109619, both unauthenticated RCE (CVSS 9.2). It says Chainguard broke the embargo 6+ hours early; Chainguard's CEO told The Register he shipped because vendors reported exploitation. AWS saw a honeypot attempt on Oct 17.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#PHP #InfoSec #Cybersecurity #OpenSource

#PHP2Shell: Wie ein #Speicherfehler zur #Shell wird.

CVE-2026-109618:

https://www.cve.org/CVERecord?id=CVE-2026-109618

CVE-2026-109619:

https://www.cve.org/CVERecord?id=CVE-2026-109619

https://youtube.com/watch?v=qXv8NAIFm9o

PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is a pair of critical RCE bugs in the PHP engine itself, not WordPress or plugins. A single unauthenticated request can lead to remote code execution. Fixed versions released 21 Oct: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 update nd restart PHP workers (php-fpm/mod_php). PHP ≤8.1 has no fix, requires upgrade.
Shared hosting? Ask your host to confirm patch.
No confirmed mass compromise per CISA as of 21 Oct, but active probing reported. #php #cyberSecurity

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

PHP 웹 런타임의 CVE-2026-109618 및 CVE-2026-109619는 인터넷에서 인증 없이 조작된 요청을 보내 PHP 워커에서 임의 코드 실행(RCE), 프로세스 접근 가능 데이터 열람, 서비스 거부를 유발할 수 있는 치명적 취약점이다. PHP 8.2~8.5의 특정 버전이 영향받으며, 완전한 해결책은 각각 PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 이상으로 즉시 업그레이드하는 것이다. 지원 종료된 PHP 5.4~8.1은 일부 임시 설정 완화책 외에는 상류 패치가 없으므로 지원되는 브랜치로 마이그레이션해야 한다. AWS Elastic B...

https://aws.amazon.com/security/security-bulletins/2026-143-aws/

PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #RCE #ExploitedInTheWild #PoC #CyberSecurity

https://securityonline.info/php2shell-exploited-poc-public/?utm_source=mastodon&utm_medium=jetpack_social

PHP 팀이 10월 21일 코어 엔진의 메모리 안전 취약점 2건(CVE-2026-109618, CVE-2026-109619)을 패치했다. PHP 5.4 이후 거의 모든 버전에 영향이 있으며, 인증 없이 프로세스 메모리의 토큰·비밀값을 읽거나 WordPress·Drupal·Joomla 등의 PHP 배포에서 원격 코드 실행이 가능했다. Wiz는 Gemini 4 Argon, GPT-5.6 Sol 등을 활용해 복잡한 익스플로잇 체인 개발·환경별 조정·탐지·패치 검증을 수행했다고 밝혔다. 영향 범위가 넓어 즉시 업데이트가 권고된다.

https://www.wiz.io/blog/php2shell-php-rce

#php #security #rce #memorysafety #aisecurity

PHP2Shell Global Response Map

PHP 코어 런타임의 치명적 RCE 취약점 CVE-2026-109618 및 CVE-2026-109619(PHP2Shell)에 대한 긴급 패치와 전 세계 대응 현황을 모은 페이지입니다. 두 취약점은 인증 없이 원격 코드 실행으로 이어질 수 있으며, Amazon Threat Intelligence는 공개 4일 전부터 실제 악용 시도를 관측했다고 밝혔습니다. WordPress만 업데이트해서는 해결되지 않고 PHP 런타임을 패치한 뒤 프로세스를 재시작해야 하며, 패치 전에는 AWS WAF 등으로 임시 완화를 적용할 수 있습니다. PHP 기반 API, AI 서비스 백엔드, 관리 도구를 운영한다면 노출 버전 확인과 즉각적인 패치·침해 흔적 점검이 필요합니다.

https://php2shell-atlas.vercel.app/

#php #rce #cve #websecurity #supplychain

SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More
https://isc.sans.edu/podcastdetail/10146

How to Fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

PHP 런타임의 치명적 RCE 취약점 2건(CVE-2026-109618, CVE-2026-109619)이 공개됐으며, 웹 요청 처리 중 메모리 손상·use-after-free를 유발해 원격 코드 실행으로 이어질 수 있다고 설명한다. 수정 버전은 PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12이며, PHP-FPM·Apache mod_php 등 웹 요청을 처리하는 배포 환경은 즉시 패치, 이미지 재빌드·재배포, 실제 실행 컨테이너의 런타임 버전 검증이 필요하다. 컨테이너 환경에서는 고정 태그보다 불변 digest를 핀ning하고, SBOM·Docker Scout·T...

https://containersecurity.dev/blog/how-to-fix-php2shell

Vulnerabilities in PHP Affecting Cisco Products: October 2026

PHP Foundation이 OOM 손상 기반 RCE(CVE-2026-109618)와 stale global state 기반 RCE(CVE-2026-109619) 두 건을...

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1

@jwz weird. https://explore.alas.aws.amazon.com/CVE-2026-109618.html and https://explore.alas.aws.amazon.com/CVE-2026-109619.html says they are fixed on 2026-10-22. I guess it's already the 22nd in some places?

Amazon just pushed out 2023.12.20261021 but it does *not* fix CVE-2026-109618 and CVE-2026-109619 so that's cool, cool. No hurry, guys. https://explore.alas.aws.amazon.com

Critical CVE vulnerabilities were announced yesterday for PHP (CVE-2026-109618 and CVE-2026-109619). We have promptly responded to that and all servers in the #TDE infrastructure have already been updated.

Show HN: I built a PHP2Shell tracker with hourly global updates

PHP2Shell 트래커는 PHP 웹 런타임의 치명적 취약점 CVE-2026-109618 및 CVE-2026-109619가 인터넷 노출 PHP 서비스에서 인증 없이 RCE·메모리 노출로 이어질 수 있다고 경고한다. 영향 가능성이 있는 웹 SAPI는 mod_php, PHP-FPM, FrankenPHP, LiteSpeed LSAPI이며, CLI 버전만 확인하지 말고 실제 웹서버·컨테이너·장기 실행 워커의 런타임 버전을 확인해야 한다. 권장 조치는 PHP 8.5.12·8.4.27·8.3.36·8.2.35 또는 배포판 백포트 패키지로 업데이트한 뒤 PHP-FPM, Apache, 큐 워커 등을 재시작하고 로그·시크릿 노출 여부를 점검하...

https://php2shell.uk/

CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window https://nefariousplan.com/posts/php-cve-2026-109618-109619-two-directions-one-window

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
https://news.ycombinator.com/item?id=50187708

#hackernews #tech

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

Link: https://aws.amazon.com/security/security-bulletins/2026-143-aws/
Discussion: https://news.ycombinator.com/item?id=50187708

Ubuntu has released security updates for php2shell (CVE-2026-109618 and CVE-2026-109619), a critical issue rated 9.2 on CVSS 4.0 that can allow remote code execution in PHP applications without authentication.

Updates cover Ubuntu 14.04 LTS through 26.10; Ubuntu Pro is required for 14.04, 16.04 and 18.04 LTS.

The separate eMudhra certificate issue could allow fake certificates if compromised.

Google, Microsoft, Apple and Mozilla…

https://en.hacks.gr/i-ubuntu-diorthonei-dyo-provlimata-asfaleias-se-efarmoges-php-kai-pistopoiitika-emudhra/

#Ubuntu #PHP #eMudhra #CVE2026109618

Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619)

Stay informed about PHP security vulnerabilities that could impact your server's integrity. Update your PHP version immediately.

🔗️ [Sucuri] https://link.is.it/RnlGmU

#Webuzo, Softaculous's hosting control panel for providers, resellers & site owners like CPANEL, has released an emergency release to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619. #PHP #PHP2shell #Selfhosting #CVE

The PHP Foundation says first signs of the flaw behind CVE-2026-109618 appeared in 2024, and the fix then stalled for months: "a structural failure." PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix it and CVE-2026-109619, both unauthenticated RCE (CVSS 9.2). It says Chainguard broke the embargo 6+ hours early; Chainguard's CEO told The Register he shipped because vendors reported exploitation. AWS saw a honeypot attempt on Oct 17.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#PHP #InfoSec #Cybersecurity #OpenSource

PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #RCE #ExploitedInTheWild #PoC #CyberSecurity

https://securityonline.info/php2shell-exploited-poc-public/?utm_source=mastodon&utm_medium=jetpack_social

SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More
https://isc.sans.edu/podcastdetail/10146

@jwz weird. https://explore.alas.aws.amazon.com/CVE-2026-109618.html and https://explore.alas.aws.amazon.com/CVE-2026-109619.html says they are fixed on 2026-10-22. I guess it's already the 22nd in some places?

Amazon just pushed out 2023.12.20261021 but it does *not* fix CVE-2026-109618 and CVE-2026-109619 so that's cool, cool. No hurry, guys. https://explore.alas.aws.amazon.com

Critical CVE vulnerabilities were announced yesterday for PHP (CVE-2026-109618 and CVE-2026-109619). We have promptly responded to that and all servers in the #TDE infrastructure have already been updated.

CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window https://nefariousplan.com/posts/php-cve-2026-109618-109619-two-directions-one-window

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
https://news.ycombinator.com/item?id=50187708

#hackernews #tech

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

Link: https://aws.amazon.com/security/security-bulletins/2026-143-aws/
Discussion: https://news.ycombinator.com/item?id=50187708

Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619)

Stay informed about PHP security vulnerabilities that could impact your server's integrity. Update your PHP version immediately.

🔗️ [Sucuri] https://link.is.it/RnlGmU

#Webuzo, Softaculous's hosting control panel for providers, resellers & site owners like CPANEL, has released an emergency release to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619. #PHP #PHP2shell #Selfhosting #CVE

PHP2Shell is now under active exploitation

https://www.linkedin.com/posts/yesterday-information-leaked-about-two-share-7518682504153796609-1os5/

https://x.com/PrevidianCyber/status/2112936591719068048

https://x.com/OliverSild/status/2112823822411866215

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

https://aws.amazon.com/security/security-bulletins/2026-143-aws/

#aws #security

@mcc I don't know if this is any help at all, but here's the update statement from my web host.

https://clients.websavers.ca/whmcs/announcements/83/Vulnerability-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619---Mitigations-Applied.html

RE: https://infosec.exchange/@Spartan_1986/117480764972910966

So, that build date got me thinking. What if Canonical did implement the fix, but they are not reporting all the build digits? I know. That's stupid. But fortunately I can check on that. I've a Pro account and the server is, of course, registered with the Pro binary installed. You can force any CVE update with a the command "sudo pro fix CVE-YYYY-XXXX". So I ran the command for the two CVEs involved with this vuln. Here's what I got:

*******************************
$ sudo pro fix CVE-2026-109618
CVE-2026-109618: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109618

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109618 is resolved.
$ sudo pro fix CVE-2026-109619
CVE-2026-109619: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109619

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109619 is resolved.
*******************************

Damn it Canonical! Digits f-ing matter!!! Why do you have to be so stupid. I frankly don't even know if I can trust this. It should report the correct version with 'php -v' you numbskulls. This is why I got out of system administration in the first place.

Fixes for PHP CVE-2026-109618 and CVE-2026-109619 have either landed or are on their way.

Fixed versions:

- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35

Check https://build.alpinelinux.org for the current status of each builder, and https://pkgs.alpinelinux.org to see what is present in each repository.

https://pkgs.alpinelinux.org/packages?name=php%253F%253F&branch=v3.24 for example shows the current version of PHP on the v3.24 branch.

Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:

The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

🚨 PHP2Shell affects multiple vulnerabilities (CVE-2026-109618, CVE-2026-109619).

https://secdb.nttzen.cloud/updates/54fddaeb-7ada-4fa6-bd70-8117eff38bc9/php2shell-vulnerability

ℹ️ Additional details, sightings and PoC:

- CVE-2026-109618 - RCE via OOM corruption - https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618
- CVE-2026-109619 - RCE via stale global state - https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619

#InfoSec #PHP2Shell #RCE #CVE2026109618 #CVE2026109619
#NTTDATA #ZENSecDB

🔒 All LimeSurvey Cloud servers have been patched against the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 released today. No action is needed for our Cloud customers.

Running LimeSurvey yourself? Please update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 as soon as possible.

#LimeSurvey #PHP #Security #php2shell

Well, so far I have not been able to obtain PHP updates for Fedora 42, 43, and 44.

I am using this as a script:

#!/bin/bash

sudo dnf clean all
sudo dnf check-update php
sudo dnf update php\*

sudo dnf update

sudo systemctl restart php-fpm
# If using Apache:
sudo systemctl restart httpd
# If using Nginx:
# sudo systemctl restart nginx

rpm -q --changelog php-cli | grep -E "CVE-2026-109618|CVE-2026-109619"

Since AWS is feeling lackadaisical about all this... Is it believed that putting this in my php-fpm pools is sufficient?

; CVE-2026-109618
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 16M

; CVE-2026-109619
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[max_file_uploads] = 20
php_admin_value[fatal_error_backtraces] = 0

🚨 We just launched a free #PHP2Shell scanner!

PHP shipped the fix for CVE-2026-109618 & CVE-2026-109619, but attackers had a head start. Find out which of your servers still run a vulnerable version. No account required: https://pentest-tools.com/network-vulnerability-scanning/php2shell-scanner

If your target is vulnerable, you get a finding with the CVSS score, severity rating, and remediation guidance, downloadable as a PDF.

Before you call it patched:
🔍 PHP hides in control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
🙈 Servers that hide their PHP version won’t show up in scan results. Check those with php -v on the host
📦 Distro packages may carry the fix without changing the version number. Check your distro’s security advisory first
⛔ On PHP 8.1 or older? Upgrade to a supported branch. Building from source? PHP published minimal backports for 7.4, 8.0, and 8.1

Fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35.

#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking

New.

Palo Alto: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products https://security.paloaltonetworks.com/CVE-2026-109618 #infosec #PHP #vulnerability

@mttaggart

Major Web Site Security Alert!

PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update immediately.

CISA POST:
"CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. " https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching #Security #CISA #PHP #CVE
#php2shell #SecurityPatch #SecurityAdvisory #Software #Risk #RemoteCodeExecution #RCE #WebSites #Internet #Web #WWW #CyberSecurity #CyberDefence

OK, sorted.

If you previously followed my example and ran #shotshare (https://www.bentasker.co.uk/posts/blog/general/deploying-shotshare-into-kubernetes.html) you're likely to be vulnerable to #php CVEs CVE-2026-109618 and CVE-2026-109619

Upstream looks to be abandoned, so I've forked and reworked the docker image to consume the fix (PR against upstream: https://github.com/mdshack/shotshare/pull/87)

In the meantime, I've pushed to my registries

* codeberg.org/bentasker/shotshare:202610-php-cve-bump
* bentasker12/shotshare:202610-php-cve-bump

Should be drop-in replacements

Claims of the PHP vulns being EITW:

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.

Here is what you need to know:

* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 

* The root is a decades-old design choice in PHP's error handling (described more in our post)

* There was evidence of in-the-wild exploitation pre-disclosure. 

The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application

We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.

What to do right now:

The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.

Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012. 

The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours. 

Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.

Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.

Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com

Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618

We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

#php2shell #php #CVE #eitw

New.

Google: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619 #Google #infosec #vulnerability #PHP

PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, two critical RCE flaws with reported exploitation. Widespread PHP use raises risk of mass compromise and outages, so prioritize patching and hunt for post-exploit activity. #PhpSecurity #RemoteCodeExecution #PatchNow

https://cyberworldops.eu/en/emergency-php-updates-address-two-critical-rce-flaws-amid-exploitation

PHP has released emergency fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical memory safety flaws in the PHP runtime that can allow unauthenticated code execution.

Upgrade now to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

🔗 https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619

watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.

https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

#eitw #php #php2shell #CVE

For those running pfSense+ (and possibly pfSense CE), it seems like PHP packages are starting to roll out:

https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619/15

#pfSense

Der Preis für die dümmste Teaser-Einleitung rund um CVE-2026-109618 und CVE-2026-109619 geht ganz klar an die #futurezone ....

»Es sollen die bisher schwerwiegendsten Sicherheitslücken sein, die je durch Künstliche Intelligenz aufgespürt wurden.«
https://futurezone.at/digital-life/php2shell-luecke-openai-google-70-prozent-des-internets/403199916

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the...

🔗️ [Securelist] https://link.is.it/nPWHOU

PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

Comments: https://news.ycombinator.com/item?id=50182987

#HackerNews #PHPFoundation #CVE2026 #SecurityUpdates #OpenSource #PHPSecurity

The path to happiness and posterity runs through PHP. Here is some of the research dealing with that today - so far.

KrebsonSecurity: Widespread PHP Flaw May Cause Many Site Outages Today https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/ @briankrebs

Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core

Cisco: Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ @TalosSecurity

CrowdStrike: Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/

Kaspersky: Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/ @Kaspersky

Sophos: Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 @SophosXOps

Palo Alto: Millions of PHP Instances Exposed - What Organizations Need To Do Right Now https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/

VulnCheck: PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 https://www.vulncheck.com/blog/php2shell-vulnerabilities @vulncheck

Socket: PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline https://socket.dev/blog/php-critical-rce-patches @SocketSecurity

Rapid7: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/ @Rapid7Official #vulnerability #threatresearch #infosec

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

#php #CISA #CVE

🚨 Rapid Response: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), can allow unauthenticated remote code execution across multiple PHP server configurations.

Censys ARC observes:
🔸 2,580,515 Internet-exposed hosts and 54,888,147 web properties running PHP
🔸 1,575,688 hosts reporting PHP versions older than the fixed releases

These figures do not represent confirmed vulnerable systems. Security fixes may be backported without changing reported version strings.

PHP has released security updates and recommends upgrading immediately.

Full advisory and Censys queries: https://censys.com/advisory/cve-2026-109618-cve-2026-109619/

#CensysARC #Cybersecurity #VulnerabilityManagement #PHP #InfoSec

PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.

If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.

Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

Нескучный октябрь.

> В целях снижения риска эксплуатации уязвимостей CVE-2026-109618 и
CVE-2026-109619 мы отключаем директиву session.upload_progress.enabled.
Некоторые функции сайтов, касающиеся индикации загрузки файлов станут недоступны.
> Патч безопасности затронет версии PHP выше 8.1, поэтому, по возможности, обновитесь до
последних версий PHP.
> Для версий ниже исправлений нет.

> Служба технической поддержки компании .masterhost

@Argyle13

Regarding PHP2shell (CVE-2026-109618 and CVE-2026-109619) vulnerability, you obviously need to patch as quickly as possible but Cloudflare has implemented some mitigation's in it's default firewall that might buy you some time. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Hey! Five alarm #infosec fire! Government websites across Europe have been taken offline following the discovery of two critical security vulnerabilities in PHP, a programming language that underpins a massive portion of the internet.

On October 21, 2026, PHP developers announced emergency patches fixing two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, giving hackers the ability to take control of servers.

PHP is pervasive. It serves as the underlying engine for major content management systems like #WordPress, #Drupal and #Joomla.

Cybersecurity teams globally are being urged to immediately isolate any vulnerable, internet-facing PHP servers until official emergency updates (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) can be manually deployed.

Cloudflare has implemented temporary firewall mitigation rules, but experts stress this is only a stopgap measure.

Go patch your #php. Now.

https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/

Auf Grund der schwerwiegenden PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 sind meine Websites aktuell und für mehrere Stunden nicht erreichbar.

PHP fixes two critical PHP RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing remote code execution. Update to 8.5.12 or 8.4.27.

#PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ModPHP #PatchNow #CyberSecurity

https://securityonline.info/php-rce-vulnerabilities-cve-2026-109618-109619/?utm_source=mastodon&utm_medium=jetpack_social

The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

The php2shell fix is out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Two critical bugs (CVSS 9.2), both remote code execution without authentication. mod_php has the highest risk, but PHP-FPM and other SAPIs are affected too. There are source backports for 7.4, 8.0 and 8.1.

Update, then do a full restart, not a reload.

Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

#PHP #InfoSec #CVE

🚨 Critical pre-authentication RCE research published for two PHP core vulnerabilities; CVE-2026-109618 + CVE-2026-109619

PoC: https://github.com/ikow/php2shell-poc

The flaws affect PHP's session.upload_progress handling and can be chained through session-file injection, memory corruption, or deserialization behavior to achieve remote code execution under specific application conditions.

CVSS: 9.2 Critical
Affected: PHP 5.4.0 through 8.5.11
Fixed: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12

The repository includes verification PoCs for session injection, a heap use-after-free, and handler-mismatch deserialization, along with a vulnerable Docker lab and detailed technical analysis.

📣 Announcing the immediate availability of:

- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12

‼️ These address the following critical security issues:

- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
:windows8: Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

#php2shell landed:

https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Wheeeeeeeee!

Unser Provider empfiehlt deutlich, die PHP-Seiten per Firewall/deny all komplett offline zu nehmen… bin gespannt, was um 16h00 disclosed wird (scheint ja in Richtung multiform upload handler zu gehen) #PHP #CVE-2026-109618 #CVE-2026-109619

PHP InfoSec

Wise system administrators who have caught wind of this bug have taken measures already

It hasn't been patched yet but you can mitigate exposure of your systems.
Better yet, do what is written on tweakers.net

Quotes:

Make your store read-only or take it offline

If you can afford to take a PHP server offline for a day, do so. PHP core developer Gina Peter Banyard calls that the most sensible option. Several Dutch sites went offline as a precaution on October 21: tech site Tweakers, the House of Representatives (Tweede Kamer), the National Cyber Security Centre (NCSC) and security news site Security.NL.

Stop PHP-FPM and have your web server show a static maintenance page. The maintenance modes built into Magento and WordPress do not help: PHP still parses each request before the application checks for the maintenance flag.

If you cannot go offline, make the store read-only. Have your web server reject every request method other than GET and HEAD, for example in nginx:

if ($request_method !~ ^(GET|HEAD)$) {
return 503;
}

Quote:

Websites overnemen

De twee kritieke kwetsbaarheden in PHP (CVE-2026-109618 en CVE-2026-109619) hebben een score van 9,2 op de CVSS v4.0-schaal, die tot 10 gaat. Dat hoge cijfer is gebaseerd op de ernst van een kwetsbaarheid en op hoe makkelijk aanvallers die kunnen misbruiken. De kwetsbaarheden zouden al sinds versie 5.4.0 in PHP zitten, die in maart 2012 uitkwam. Aanvallers kunnen door de kwetsbaarheden eigen webpagina's publiceren. Daardoor kunnen zij mogelijk malware verspreiden. Daarnaast zou de zogeheten PHP2Shell-exploit het mogelijk maken om eigen code uit te voeren op kwetsbare servers.

Volgens verschillende beveiligingsadviezen kan het helpen om session.upload_progress.enabled uit te schakelen. Een bijbehorende tijdelijke oplossing zou zijn om session.use_strict_mode in te schakelen. Beveiligingsexpert Kevin Beaumont meldt dat de Linux-kernelbeveiligingsmodule AppArmor of SELinux ook bescherming biedt tegen misbruik van deze grote PHP-kwetsbaarheden.

I understand the NL language
Translate this if you don't

Jump to the sources read and work

Sources:

https://jackalsyn.com/posts/php-up-2026.html

https://sansec.io/research/php2shell

https://tweakers.net/

#PHP #bug #serious #infoSEC #programming #upgrade

🚨 If you run PHP (like most of the internet does), this one can’t wait: #PHP2Shell = 2 critical RCE flaws in PHP core leaked before the patch, with live attacks already reported.

Because CVE-2026-109618 & CVE-2026-109619 sit in PHP itself, every app on a vulnerable PHP version is exposed, no matter what runs on top.

That’s why we’re building detection in our Network Scanner + an exploit module in Sniper as you’re reading this. Stay tuned for the launch announcement!

What to do now:

Inventory every PHP install, including control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
Patch as soon as PHP’s release is out, then restart PHP-FPM or your web server
On PHP 8.1 or older? No fix is coming. Upgrade, or take those systems off the internet
Alert on PHP processes spawning shells, interpreters, or download tools

#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking

@thomasfuchs that's spooky. Remote-code execution 😬

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

> From what has been reported, the flaws are in how PHP processes file-upload requests. When a browser sends a form that contains a file, it uses a multipart/form-data request, which is a request body split into separate parts for each field and file. PHP reads and splits that body itself before your application code runs.

Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)
#CVE_2026_109618 #CVE_2026_109619
https://watchtowr.com/intelligence/php-cve-2026-109618-faq/

🔧 Dočasně vypínáme podporu přes FreeScout (helpdesk.oscloud.cz) kvůli kritické chybě v PHP. Znovu ji zapneme po aplikování opravy.

⚠️ Kritická zranitelnost v PHP, co to znamená pro OSCloud

PHP tým oznámil dvě kritické chyby (CVE-2026-109618 a CVE-2026-109619, obě CVSS 9.2). Mohou umožnit spuštění cizího kódu na serveru bez přihlášení. Oprava vychází dnes v 16:00 SEČ/CEST. Podle hlášení bezpečnostních firem už probíhají první útoky.

Kterých služeb se to týká:
• Nextcloud, WordPress, Pixelfed, FreeScout, a další aplikace postavené na PHP
• LAMP weby zákazníků (Apache + PHP), včetně těch, kde zatím běží jen úvodní stránka

Kterých ne:
• Mastodon, Matrix, PeerTube, Gitea (PHP nepoužívají)
• Weby a úložiště na statických souborech (Surfer)

Co děláme:
• FreeScout jsme vypnuli
• Další PHP aplikace a LAMP weby budeme vypínat postupně a vždy o tom budeme informovat zde. Počítejte s tím, že dočasně vypneme i Nextcloud, a to do vydání a nasazení opravy
• Jakmile budou dostupné opravené verze aplikací, nasadíme je co nejdřív
• Před vypnutím a updaty děláme zálohy

Co to znamená pro vás:
• Podpora přes FreeScout je do opravy nedostupná
• Nextcloud, LAMP weby a další PHP služby mohou být dnes nedostupné
• Pokud by se při updatu něco pokazilo, vracíme se ze zálohy maximálně 12 hodin zpět

Opravu nelze řešit pluginy ani updatem WordPressu, musí přijít nové PHP v rámci aktualizace aplikace. Pokud provozujete vlastní PHP web mimo OSCloud, aktualizujte PHP hned, jak vyjde oprava.

Děkujeme za trpělivost. Stav budeme průběžně aktualizovat v tomto vlákně.

#OSCloud #PHP #Bezpečnost

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) https://isc.sans.edu/diary/33440

Milhões de servidores PHP expostos ao risco da falha PHP2Shell. A recente divulgação de detalhes técnicos sobre as vulnerabilidades críticas no PHP (CVE-2026-109618 e CVE-2026-109619) acendeu os alertas no setor. 🚨

🔗 https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell

#apache #dados #equipa #falha #risco 

ENDLESS CVE WEDNESDAY PART FIVE BABYYYYYYYYYY THREE NEW PERFECT 10S IN APACHE TRAFFIC SERVER, THE RIDE NEVER ENDS

www.cve.org/CVERecord?id...
www.cve.org/CVERecord?id...
www.cve.org/CVERecord?id...

cve.org/CVERecord?id=C...

Cisco fixes 13 Snort 3 vulnerabilities, including CVE-2026-20043 and denial of service flaws affecting FTD, Meraki MX and IOS XE.

#Snort3 #Cisco #CVE202620043 #CVE202620291 #CVE202676524 #DenialOfService #FirewallSecurity #CyberSecurity

https://securityonline.info/cisco-snort-3-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Cisco fixes 13 Snort 3 vulnerabilities, including CVE-2026-20043 and denial of service flaws affecting FTD, Meraki MX and IOS XE.

#Snort3 #Cisco #CVE202620043 #CVE202620291 #CVE202676524 #DenialOfService #FirewallSecurity #CyberSecurity

https://securityonline.info/cisco-snort-3-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Patch 13 Apache Pulsar vulnerabilities and 4 Apache IoTDB flaws now, including critical bugs CVE-2026-105944, CVE-2026-105869, and CVE-2026-59229.

#ApachePulsar #ApacheIoTDB #Apache #Cybersecurity #Vulnerability #CloudSecurity #InfoSec

https://securityonline.info/apache-pulsar-vulnerabilities-iotdb-patched/?utm_source=mastodon&utm_medium=jetpack_social

Patch 13 Apache Pulsar vulnerabilities and 4 Apache IoTDB flaws now, including critical bugs CVE-2026-105944, CVE-2026-105869, and CVE-2026-59229.

#ApachePulsar #ApacheIoTDB #Apache #Cybersecurity #Vulnerability #CloudSecurity #InfoSec

https://securityonline.info/apache-pulsar-vulnerabilities-iotdb-patched/?utm_source=mastodon&utm_medium=jetpack_social

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco's security hardening release fixes Cisco Unified CM vulnerabilities, including CVSS 9.8 flaws CVE-2026-76473 and CVE-2026-76474.

#Cisco #UnifiedCM #CVE202676473 #CVE202676474 #CVE202676487 #SecurityHardening #VoIP #CyberSecurity

https://securityonline.info/cisco-unified-cm-vulnerabilities-hardening/?utm_source=mastodon&utm_medium=jetpack_social

Cisco's security hardening release fixes Cisco Unified CM vulnerabilities, including CVSS 9.8 flaws CVE-2026-76473 and CVE-2026-76474.

#Cisco #UnifiedCM #CVE202676473 #CVE202676474 #CVE202676487 #SecurityHardening #VoIP #CyberSecurity

https://securityonline.info/cisco-unified-cm-vulnerabilities-hardening/?utm_source=mastodon&utm_medium=jetpack_social

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Review the latest Cisco security advisory to patch 10 Cisco Expressway vulnerabilities, including critical 9.8 CVSS root RCE flaw CVE-2026-76466.

#Cisco #CiscoExpressway #RCE #CVE202676466 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/cisco-expressway-vulnerabilities-root-rce-patched/?utm_source=mastodon&utm_medium=jetpack_social

Review the latest Cisco security advisory to patch 10 Cisco Expressway vulnerabilities, including critical 9.8 CVSS root RCE flaw CVE-2026-76466.

#Cisco #CiscoExpressway #RCE #CVE202676466 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/cisco-expressway-vulnerabilities-root-rce-patched/?utm_source=mastodon&utm_medium=jetpack_social

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

Cisco's security hardening release fixes Cisco Unified CM vulnerabilities, including CVSS 9.8 flaws CVE-2026-76473 and CVE-2026-76474.

#Cisco #UnifiedCM #CVE202676473 #CVE202676474 #CVE202676487 #SecurityHardening #VoIP #CyberSecurity

https://securityonline.info/cisco-unified-cm-vulnerabilities-hardening/?utm_source=mastodon&utm_medium=jetpack_social

Cisco's security hardening release fixes Cisco Unified CM vulnerabilities, including CVSS 9.8 flaws CVE-2026-76473 and CVE-2026-76474.

#Cisco #UnifiedCM #CVE202676473 #CVE202676474 #CVE202676487 #SecurityHardening #VoIP #CyberSecurity

https://securityonline.info/cisco-unified-cm-vulnerabilities-hardening/?utm_source=mastodon&utm_medium=jetpack_social

Cisco advisories, all new, all critical.

CRITICAL: CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475Cisco: Unified Communications Products Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3

CRITICAL: CVE-2026-76466: Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t

CRITICAL: CVE-2026-20043, CVE-2026-20236, and CVE-2026-20291: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe @TalosSecurity #Cisco #vulnerability #infosec #Cisco

@cR0w

The PHP Foundation says first signs of the flaw behind CVE-2026-109618 appeared in 2024, and the fix then stalled for months: "a structural failure." PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix it and CVE-2026-109619, both unauthenticated RCE (CVSS 9.2). It says Chainguard broke the embargo 6+ hours early; Chainguard's CEO told The Register he shipped because vendors reported exploitation. AWS saw a honeypot attempt on Oct 17.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#PHP #InfoSec #Cybersecurity #OpenSource

#PHP2Shell: Wie ein #Speicherfehler zur #Shell wird.

CVE-2026-109618:

https://www.cve.org/CVERecord?id=CVE-2026-109618

CVE-2026-109619:

https://www.cve.org/CVERecord?id=CVE-2026-109619

https://youtube.com/watch?v=qXv8NAIFm9o

PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is a pair of critical RCE bugs in the PHP engine itself, not WordPress or plugins. A single unauthenticated request can lead to remote code execution. Fixed versions released 21 Oct: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 update nd restart PHP workers (php-fpm/mod_php). PHP ≤8.1 has no fix, requires upgrade.
Shared hosting? Ask your host to confirm patch.
No confirmed mass compromise per CISA as of 21 Oct, but active probing reported. #php #cyberSecurity

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

PHP 웹 런타임의 CVE-2026-109618 및 CVE-2026-109619는 인터넷에서 인증 없이 조작된 요청을 보내 PHP 워커에서 임의 코드 실행(RCE), 프로세스 접근 가능 데이터 열람, 서비스 거부를 유발할 수 있는 치명적 취약점이다. PHP 8.2~8.5의 특정 버전이 영향받으며, 완전한 해결책은 각각 PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 이상으로 즉시 업그레이드하는 것이다. 지원 종료된 PHP 5.4~8.1은 일부 임시 설정 완화책 외에는 상류 패치가 없으므로 지원되는 브랜치로 마이그레이션해야 한다. AWS Elastic B...

https://aws.amazon.com/security/security-bulletins/2026-143-aws/

PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #RCE #ExploitedInTheWild #PoC #CyberSecurity

https://securityonline.info/php2shell-exploited-poc-public/?utm_source=mastodon&utm_medium=jetpack_social

PHP 팀이 10월 21일 코어 엔진의 메모리 안전 취약점 2건(CVE-2026-109618, CVE-2026-109619)을 패치했다. PHP 5.4 이후 거의 모든 버전에 영향이 있으며, 인증 없이 프로세스 메모리의 토큰·비밀값을 읽거나 WordPress·Drupal·Joomla 등의 PHP 배포에서 원격 코드 실행이 가능했다. Wiz는 Gemini 4 Argon, GPT-5.6 Sol 등을 활용해 복잡한 익스플로잇 체인 개발·환경별 조정·탐지·패치 검증을 수행했다고 밝혔다. 영향 범위가 넓어 즉시 업데이트가 권고된다.

https://www.wiz.io/blog/php2shell-php-rce

#php #security #rce #memorysafety #aisecurity

PHP2Shell Global Response Map

PHP 코어 런타임의 치명적 RCE 취약점 CVE-2026-109618 및 CVE-2026-109619(PHP2Shell)에 대한 긴급 패치와 전 세계 대응 현황을 모은 페이지입니다. 두 취약점은 인증 없이 원격 코드 실행으로 이어질 수 있으며, Amazon Threat Intelligence는 공개 4일 전부터 실제 악용 시도를 관측했다고 밝혔습니다. WordPress만 업데이트해서는 해결되지 않고 PHP 런타임을 패치한 뒤 프로세스를 재시작해야 하며, 패치 전에는 AWS WAF 등으로 임시 완화를 적용할 수 있습니다. PHP 기반 API, AI 서비스 백엔드, 관리 도구를 운영한다면 노출 버전 확인과 즉각적인 패치·침해 흔적 점검이 필요합니다.

https://php2shell-atlas.vercel.app/

#php #rce #cve #websecurity #supplychain

SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More
https://isc.sans.edu/podcastdetail/10146

How to Fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

PHP 런타임의 치명적 RCE 취약점 2건(CVE-2026-109618, CVE-2026-109619)이 공개됐으며, 웹 요청 처리 중 메모리 손상·use-after-free를 유발해 원격 코드 실행으로 이어질 수 있다고 설명한다. 수정 버전은 PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12이며, PHP-FPM·Apache mod_php 등 웹 요청을 처리하는 배포 환경은 즉시 패치, 이미지 재빌드·재배포, 실제 실행 컨테이너의 런타임 버전 검증이 필요하다. 컨테이너 환경에서는 고정 태그보다 불변 digest를 핀ning하고, SBOM·Docker Scout·T...

https://containersecurity.dev/blog/how-to-fix-php2shell

Vulnerabilities in PHP Affecting Cisco Products: October 2026

PHP Foundation이 OOM 손상 기반 RCE(CVE-2026-109618)와 stale global state 기반 RCE(CVE-2026-109619) 두 건을...

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1

@jwz weird. https://explore.alas.aws.amazon.com/CVE-2026-109618.html and https://explore.alas.aws.amazon.com/CVE-2026-109619.html says they are fixed on 2026-10-22. I guess it's already the 22nd in some places?

Amazon just pushed out 2023.12.20261021 but it does *not* fix CVE-2026-109618 and CVE-2026-109619 so that's cool, cool. No hurry, guys. https://explore.alas.aws.amazon.com

Critical CVE vulnerabilities were announced yesterday for PHP (CVE-2026-109618 and CVE-2026-109619). We have promptly responded to that and all servers in the #TDE infrastructure have already been updated.

Show HN: I built a PHP2Shell tracker with hourly global updates

PHP2Shell 트래커는 PHP 웹 런타임의 치명적 취약점 CVE-2026-109618 및 CVE-2026-109619가 인터넷 노출 PHP 서비스에서 인증 없이 RCE·메모리 노출로 이어질 수 있다고 경고한다. 영향 가능성이 있는 웹 SAPI는 mod_php, PHP-FPM, FrankenPHP, LiteSpeed LSAPI이며, CLI 버전만 확인하지 말고 실제 웹서버·컨테이너·장기 실행 워커의 런타임 버전을 확인해야 한다. 권장 조치는 PHP 8.5.12·8.4.27·8.3.36·8.2.35 또는 배포판 백포트 패키지로 업데이트한 뒤 PHP-FPM, Apache, 큐 워커 등을 재시작하고 로그·시크릿 노출 여부를 점검하...

https://php2shell.uk/

CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window https://nefariousplan.com/posts/php-cve-2026-109618-109619-two-directions-one-window

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
https://news.ycombinator.com/item?id=50187708

#hackernews #tech

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

Link: https://aws.amazon.com/security/security-bulletins/2026-143-aws/
Discussion: https://news.ycombinator.com/item?id=50187708

Ubuntu has released security updates for php2shell (CVE-2026-109618 and CVE-2026-109619), a critical issue rated 9.2 on CVSS 4.0 that can allow remote code execution in PHP applications without authentication.

Updates cover Ubuntu 14.04 LTS through 26.10; Ubuntu Pro is required for 14.04, 16.04 and 18.04 LTS.

The separate eMudhra certificate issue could allow fake certificates if compromised.

Google, Microsoft, Apple and Mozilla…

https://en.hacks.gr/i-ubuntu-diorthonei-dyo-provlimata-asfaleias-se-efarmoges-php-kai-pistopoiitika-emudhra/

#Ubuntu #PHP #eMudhra #CVE2026109618

Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619)

Stay informed about PHP security vulnerabilities that could impact your server's integrity. Update your PHP version immediately.

🔗️ [Sucuri] https://link.is.it/RnlGmU

Okay ( and thanks @gizmomathboy ) nice, nice, now we're talking.

Local-only exploit tester.

So now I just have to decide whether to trust… running PHP code on my server… written by an unknown third party… whose github is overflowing with AI slop.

https://github.com/slabbdev/php2shell-cve-2026-109618-109619

…oh. Hm. Maybe I didn't think through the implications of trawling the internet looking for vulnerability exploits to run on my server

Two serious vulnerabilities have been identified in PHP, which is used by around 70% of websites worldwide.

The PHP Foundation released fixes on October 21, 2026.

VulnCheck, Cloudflare and Patchstack reported attempts to investigate the flaws from malicious IP addresses.

One attempt tied to CVE-2026-109618 failed because the targeted file was not present.

Cloudflare also reported attempts to bypass defenses by changing…

https://en.hacks.gr/dyo-kena-asfaleias-stin-php-kai-idi-katagrafontai-apopeires-eisvolis/

#PHP #CVE2026109618 #PHPFoundation #Patchstack

#Webuzo, Softaculous's hosting control panel for providers, resellers & site owners like CPANEL, has released an emergency release to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619. #PHP #PHP2shell #Selfhosting #CVE

The PHP Foundation says first signs of the flaw behind CVE-2026-109618 appeared in 2024, and the fix then stalled for months: "a structural failure." PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix it and CVE-2026-109619, both unauthenticated RCE (CVSS 9.2). It says Chainguard broke the embargo 6+ hours early; Chainguard's CEO told The Register he shipped because vendors reported exploitation. AWS saw a honeypot attempt on Oct 17.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#PHP #InfoSec #Cybersecurity #OpenSource

PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #RCE #ExploitedInTheWild #PoC #CyberSecurity

https://securityonline.info/php2shell-exploited-poc-public/?utm_source=mastodon&utm_medium=jetpack_social

SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More
https://isc.sans.edu/podcastdetail/10146

@jwz weird. https://explore.alas.aws.amazon.com/CVE-2026-109618.html and https://explore.alas.aws.amazon.com/CVE-2026-109619.html says they are fixed on 2026-10-22. I guess it's already the 22nd in some places?

Amazon just pushed out 2023.12.20261021 but it does *not* fix CVE-2026-109618 and CVE-2026-109619 so that's cool, cool. No hurry, guys. https://explore.alas.aws.amazon.com

Critical CVE vulnerabilities were announced yesterday for PHP (CVE-2026-109618 and CVE-2026-109619). We have promptly responded to that and all servers in the #TDE infrastructure have already been updated.

CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window https://nefariousplan.com/posts/php-cve-2026-109618-109619-two-directions-one-window

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
https://news.ycombinator.com/item?id=50187708

#hackernews #tech

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

Link: https://aws.amazon.com/security/security-bulletins/2026-143-aws/
Discussion: https://news.ycombinator.com/item?id=50187708

Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619)

Stay informed about PHP security vulnerabilities that could impact your server's integrity. Update your PHP version immediately.

🔗️ [Sucuri] https://link.is.it/RnlGmU

Okay ( and thanks @gizmomathboy ) nice, nice, now we're talking.

Local-only exploit tester.

So now I just have to decide whether to trust… running PHP code on my server… written by an unknown third party… whose github is overflowing with AI slop.

https://github.com/slabbdev/php2shell-cve-2026-109618-109619

…oh. Hm. Maybe I didn't think through the implications of trawling the internet looking for vulnerability exploits to run on my server

#Webuzo, Softaculous's hosting control panel for providers, resellers & site owners like CPANEL, has released an emergency release to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619. #PHP #PHP2shell #Selfhosting #CVE

【PHP脆弱性php2shell】WordPressも対象、パッチは21:59に公開済み。「23:15から乗っ取り」「15分でAIが攻撃コード？」は本当か、自分のVPSのログで検証（CVE-2026-109618／109619）：秋山大志のそれとりあえず作ってみようか。：オルタナティブ・ブログ: https://blogs.itmedia.co.jp/agile/2026/10/php2shell_cve_2026_109618_panic.html

PHP2Shell is now under active exploitation

https://www.linkedin.com/posts/yesterday-information-leaked-about-two-share-7518682504153796609-1os5/

https://x.com/PrevidianCyber/status/2112936591719068048

https://x.com/OliverSild/status/2112823822411866215

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

https://aws.amazon.com/security/security-bulletins/2026-143-aws/

#aws #security

@mcc I don't know if this is any help at all, but here's the update statement from my web host.

https://clients.websavers.ca/whmcs/announcements/83/Vulnerability-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619---Mitigations-Applied.html

PHP2Shell (CVE-2026-109618/109619): first exploit requests arrived 5.5 hours before PHP shipped the fix, and the "scanners" carry Mirai-style loaders https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/

RE: https://infosec.exchange/@Spartan_1986/117480764972910966

So, that build date got me thinking. What if Canonical did implement the fix, but they are not reporting all the build digits? I know. That's stupid. But fortunately I can check on that. I've a Pro account and the server is, of course, registered with the Pro binary installed. You can force any CVE update with a the command "sudo pro fix CVE-YYYY-XXXX". So I ran the command for the two CVEs involved with this vuln. Here's what I got:

*******************************
$ sudo pro fix CVE-2026-109618
CVE-2026-109618: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109618

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109618 is resolved.
$ sudo pro fix CVE-2026-109619
CVE-2026-109619: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109619

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109619 is resolved.
*******************************

Damn it Canonical! Digits f-ing matter!!! Why do you have to be so stupid. I frankly don't even know if I can trust this. It should report the correct version with 'php -v' you numbskulls. This is why I got out of system administration in the first place.

Fixes for PHP CVE-2026-109618 and CVE-2026-109619 have either landed or are on their way.

Fixed versions:

- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35

Check https://build.alpinelinux.org for the current status of each builder, and https://pkgs.alpinelinux.org to see what is present in each repository.

https://pkgs.alpinelinux.org/packages?name=php%253F%253F&branch=v3.24 for example shows the current version of PHP on the v3.24 branch.

Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:

The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

🚨 PHP2Shell affects multiple vulnerabilities (CVE-2026-109618, CVE-2026-109619).

https://secdb.nttzen.cloud/updates/54fddaeb-7ada-4fa6-bd70-8117eff38bc9/php2shell-vulnerability

ℹ️ Additional details, sightings and PoC:

- CVE-2026-109618 - RCE via OOM corruption - https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618
- CVE-2026-109619 - RCE via stale global state - https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619

#InfoSec #PHP2Shell #RCE #CVE2026109618 #CVE2026109619
#NTTDATA #ZENSecDB

🔒 All LimeSurvey Cloud servers have been patched against the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 released today. No action is needed for our Cloud customers.

Running LimeSurvey yourself? Please update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 as soon as possible.

#LimeSurvey #PHP #Security #php2shell

Well, so far I have not been able to obtain PHP updates for Fedora 42, 43, and 44.

I am using this as a script:

#!/bin/bash

sudo dnf clean all
sudo dnf check-update php
sudo dnf update php\*

sudo dnf update

sudo systemctl restart php-fpm
# If using Apache:
sudo systemctl restart httpd
# If using Nginx:
# sudo systemctl restart nginx

rpm -q --changelog php-cli | grep -E "CVE-2026-109618|CVE-2026-109619"

Since AWS is feeling lackadaisical about all this... Is it believed that putting this in my php-fpm pools is sufficient?

; CVE-2026-109618
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 16M

; CVE-2026-109619
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[max_file_uploads] = 20
php_admin_value[fatal_error_backtraces] = 0

🚨 We just launched a free #PHP2Shell scanner!

PHP shipped the fix for CVE-2026-109618 & CVE-2026-109619, but attackers had a head start. Find out which of your servers still run a vulnerable version. No account required: https://pentest-tools.com/network-vulnerability-scanning/php2shell-scanner

If your target is vulnerable, you get a finding with the CVSS score, severity rating, and remediation guidance, downloadable as a PDF.

Before you call it patched:
🔍 PHP hides in control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
🙈 Servers that hide their PHP version won’t show up in scan results. Check those with php -v on the host
📦 Distro packages may carry the fix without changing the version number. Check your distro’s security advisory first
⛔ On PHP 8.1 or older? Upgrade to a supported branch. Building from source? PHP published minimal backports for 7.4, 8.0, and 8.1

Fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35.

#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking

#php2shell - Für #Serveradmin , die noch ältere Versionen, zumindest eine zeitlang, benötigen, bietet @php Backports für die folgenden #PHP-Versionen an. So kann man eine gepachte Version selbst bauen.

#PHP74 https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619

#PHP80 https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619

#PHP81 https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619

New.

Palo Alto: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products https://security.paloaltonetworks.com/CVE-2026-109618 #infosec #PHP #vulnerability

@mttaggart

Notable PHP Enjoyer Palo Alto has posted their advisory on #PHP2Shell:

https://security.paloaltonetworks.com/CVE-2026-109618

ALL versions of Panorama and PAN-OS are affected. There's a fix coming, but right now I recommend shutting down anything exposed publicly, like VPN portals.

Must-read blog post from the PHP foundation:

> [ In 2024 ] a PHP core developer contracted by the PHP Foundation found the first signs of the [out-of-memory] OOM problem behind CVE-2026-109618.

> the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#php2shell

Major Web Site Security Alert!

PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update immediately.

CISA POST:
"CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. " https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching #Security #CISA #PHP #CVE
#php2shell #SecurityPatch #SecurityAdvisory #Software #Risk #RemoteCodeExecution #RCE #WebSites #Internet #Web #WWW #CyberSecurity #CyberDefence

OK, sorted.

If you previously followed my example and ran #shotshare (https://www.bentasker.co.uk/posts/blog/general/deploying-shotshare-into-kubernetes.html) you're likely to be vulnerable to #php CVEs CVE-2026-109618 and CVE-2026-109619

Upstream looks to be abandoned, so I've forked and reworked the docker image to consume the fix (PR against upstream: https://github.com/mdshack/shotshare/pull/87)

In the meantime, I've pushed to my registries

* codeberg.org/bentasker/shotshare:202610-php-cve-bump
* bentasker12/shotshare:202610-php-cve-bump

Should be drop-in replacements

Claims of the PHP vulns being EITW:

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.

Here is what you need to know:

* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 

* The root is a decades-old design choice in PHP's error handling (described more in our post)

* There was evidence of in-the-wild exploitation pre-disclosure. 

The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application

We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.

What to do right now:

The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.

Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012. 

The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours. 

Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.

Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.

Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com

Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618

We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

#php2shell #php #CVE #eitw

New.

Google: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619 #Google #infosec #vulnerability #PHP

PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, two critical RCE flaws with reported exploitation. Widespread PHP use raises risk of mass compromise and outages, so prioritize patching and hunt for post-exploit activity. #PhpSecurity #RemoteCodeExecution #PatchNow

https://cyberworldops.eu/en/emergency-php-updates-address-two-critical-rce-flaws-amid-exploitation

PHP has released emergency fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical memory safety flaws in the PHP runtime that can allow unauthenticated code execution.

Upgrade now to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

🔗 https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619

What the PHP2Shell rumors got wrong, from inside the PHP security team https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

Palo finally published an advisory:

https://security.paloaltonetworks.com/CVE-2026-109618

No patch but some customers can get detections. Thanks, Palo. Fucking worthless fucks.

Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.

After publication of the vulnerability and patches, Advanced Threat Prevention (ATP) will release standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625), on Oct 21st.

The security risk posed by this issue on PAN-OS is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.

watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.

https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

#eitw #php #php2shell #CVE

"Plusieurs vulnérabilités critiques découvertes dans #PHP : installez immédiatement les mises à jour de sécurité"

"Deux vulnérabilités critiques dans PHP pourraient permettre à un attaquant d'exécuter du code malveillant sur les serveurs concernés sans avoir à s’authentifier. Des mises à jour de sécurité sont désormais disponibles. L'Office fédéral de la cybersécurité (OFCS) recommande de mettre à jour immédiatement les systèmes concernés. Outre les serveurs web, vérifiez également les applications et les appareils qui utilisent PHP comme composant intégré."
👇
https://www.bacs.admin.ch/fr/warnung-php-fr

🔍
👇
https://security-hub.ncsc.admin.ch/#/posts/13083

🇪🇺
👇
https://db.gcve.eu/vuln/CVE-2026-109618

#CyberVeille #PHP2shell

For those running pfSense+ (and possibly pfSense CE), it seems like PHP packages are starting to roll out:

https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619/15

#pfSense

Der Preis für die dümmste Teaser-Einleitung rund um CVE-2026-109618 und CVE-2026-109619 geht ganz klar an die #futurezone ....

»Es sollen die bisher schwerwiegendsten Sicherheitslücken sein, die je durch Künstliche Intelligenz aufgespürt wurden.«
https://futurezone.at/digital-life/php2shell-luecke-openai-google-70-prozent-des-internets/403199916

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the...

🔗️ [Securelist] https://link.is.it/nPWHOU

PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

Comments: https://news.ycombinator.com/item?id=50182987

#HackerNews #PHPFoundation #CVE2026 #SecurityUpdates #OpenSource #PHPSecurity

The path to happiness and posterity runs through PHP. Here is some of the research dealing with that today - so far.

KrebsonSecurity: Widespread PHP Flaw May Cause Many Site Outages Today https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/ @briankrebs

Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core

Cisco: Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ @TalosSecurity

CrowdStrike: Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/

Kaspersky: Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/ @Kaspersky

Sophos: Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 @SophosXOps

Palo Alto: Millions of PHP Instances Exposed - What Organizations Need To Do Right Now https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/

VulnCheck: PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 https://www.vulncheck.com/blog/php2shell-vulnerabilities @vulncheck

Socket: PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline https://socket.dev/blog/php-critical-rce-patches @SocketSecurity

Rapid7: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/ @Rapid7Official #vulnerability #threatresearch #infosec

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

#php #CISA #CVE

🚨 Rapid Response: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), can allow unauthenticated remote code execution across multiple PHP server configurations.

Censys ARC observes:
🔸 2,580,515 Internet-exposed hosts and 54,888,147 web properties running PHP
🔸 1,575,688 hosts reporting PHP versions older than the fixed releases

These figures do not represent confirmed vulnerable systems. Security fixes may be backported without changing reported version strings.

PHP has released security updates and recommends upgrading immediately.

Full advisory and Censys queries: https://censys.com/advisory/cve-2026-109618-cve-2026-109619/

#CensysARC #Cybersecurity #VulnerabilityManagement #PHP #InfoSec

PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.

If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.

Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

Нескучный октябрь.

> В целях снижения риска эксплуатации уязвимостей CVE-2026-109618 и
CVE-2026-109619 мы отключаем директиву session.upload_progress.enabled.
Некоторые функции сайтов, касающиеся индикации загрузки файлов станут недоступны.
> Патч безопасности затронет версии PHP выше 8.1, поэтому, по возможности, обновитесь до
последних версий PHP.
> Для версий ниже исправлений нет.

> Служба технической поддержки компании .masterhost

@Argyle13

Regarding PHP2shell (CVE-2026-109618 and CVE-2026-109619) vulnerability, you obviously need to patch as quickly as possible but Cloudflare has implemented some mitigation's in it's default firewall that might buy you some time. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Hey! Five alarm #infosec fire! Government websites across Europe have been taken offline following the discovery of two critical security vulnerabilities in PHP, a programming language that underpins a massive portion of the internet.

On October 21, 2026, PHP developers announced emergency patches fixing two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, giving hackers the ability to take control of servers.

PHP is pervasive. It serves as the underlying engine for major content management systems like #WordPress, #Drupal and #Joomla.

Cybersecurity teams globally are being urged to immediately isolate any vulnerable, internet-facing PHP servers until official emergency updates (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) can be manually deployed.

Cloudflare has implemented temporary firewall mitigation rules, but experts stress this is only a stopgap measure.

Go patch your #php. Now.

https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/

Auf Grund der schwerwiegenden PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 sind meine Websites aktuell und für mehrere Stunden nicht erreichbar.

PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and...

🔗️ [Bleepingcomputer] https://link.is.it/LMjG6I

Jesus Christ patch your shit now

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-109618/

Jesus Christ patch your shit n...

Jesus Christ patch your shit now

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-109618/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

@RensBloom I am also awaiting the update for Ubuntu. It got applied quickly (https://ubuntu.com/security/CVE-2026-109618#status) but now is the wait till all mirrors are updated I guess. Or manually add a repo which has the update.

PHP fixes two critical PHP RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing remote code execution. Update to 8.5.12 or 8.4.27.

#PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ModPHP #PatchNow #CyberSecurity

https://securityonline.info/php-rce-vulnerabilities-cve-2026-109618-109619/?utm_source=mastodon&utm_medium=jetpack_social

The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

The php2shell fix is out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Two critical bugs (CVSS 9.2), both remote code execution without authentication. mod_php has the highest risk, but PHP-FPM and other SAPIs are affected too. There are source backports for 7.4, 8.0 and 8.1.

Update, then do a full restart, not a reload.

Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

#PHP #InfoSec #CVE

🚨 Critical pre-authentication RCE research published for two PHP core vulnerabilities; CVE-2026-109618 + CVE-2026-109619

PoC: https://github.com/ikow/php2shell-poc

The flaws affect PHP's session.upload_progress handling and can be chained through session-file injection, memory corruption, or deserialization behavior to achieve remote code execution under specific application conditions.

CVSS: 9.2 Critical
Affected: PHP 5.4.0 through 8.5.11
Fixed: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12

The repository includes verification PoCs for session injection, a heap use-after-free, and handler-mismatch deserialization, along with a vulnerable Docker lab and detailed technical analysis.

📣 Announcing the immediate availability of:

- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12

‼️ These address the following critical security issues:

- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
:windows8: Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

Zwei kritische PHP-Lücken (CVE-2026-109618/109619, CVSS 9,2) ermöglichen unter bestimmten Bedingungen die Ausführung von Schadcode auf Webservern.

Dringend patchen! Für PHP 8.4 ist Version 8.4.27 erforderlich. Unter Debian 13 sind die Updates bereits verfügbar:

apt update && apt upgrade

Anschließend PHP-FPM neu starten:

systemctl restart php8.4-fpm

Auch andere Distributionen sollten jetzt aktualisiert werden!

https://www.php.net/archive/2026.php

#PHP #ITSecurity

#php2shell landed:

https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Wheeeeeeeee!

Unser Provider empfiehlt deutlich, die PHP-Seiten per Firewall/deny all komplett offline zu nehmen… bin gespannt, was um 16h00 disclosed wird (scheint ja in Richtung multiform upload handler zu gehen) #PHP #CVE-2026-109618 #CVE-2026-109619

PHP InfoSec

Wise system administrators who have caught wind of this bug have taken measures already

It hasn't been patched yet but you can mitigate exposure of your systems.
Better yet, do what is written on tweakers.net

Quotes:

Make your store read-only or take it offline

If you can afford to take a PHP server offline for a day, do so. PHP core developer Gina Peter Banyard calls that the most sensible option. Several Dutch sites went offline as a precaution on October 21: tech site Tweakers, the House of Representatives (Tweede Kamer), the National Cyber Security Centre (NCSC) and security news site Security.NL.

Stop PHP-FPM and have your web server show a static maintenance page. The maintenance modes built into Magento and WordPress do not help: PHP still parses each request before the application checks for the maintenance flag.

If you cannot go offline, make the store read-only. Have your web server reject every request method other than GET and HEAD, for example in nginx:

if ($request_method !~ ^(GET|HEAD)$) {
return 503;
}

Quote:

Websites overnemen

De twee kritieke kwetsbaarheden in PHP (CVE-2026-109618 en CVE-2026-109619) hebben een score van 9,2 op de CVSS v4.0-schaal, die tot 10 gaat. Dat hoge cijfer is gebaseerd op de ernst van een kwetsbaarheid en op hoe makkelijk aanvallers die kunnen misbruiken. De kwetsbaarheden zouden al sinds versie 5.4.0 in PHP zitten, die in maart 2012 uitkwam. Aanvallers kunnen door de kwetsbaarheden eigen webpagina's publiceren. Daardoor kunnen zij mogelijk malware verspreiden. Daarnaast zou de zogeheten PHP2Shell-exploit het mogelijk maken om eigen code uit te voeren op kwetsbare servers.

Volgens verschillende beveiligingsadviezen kan het helpen om session.upload_progress.enabled uit te schakelen. Een bijbehorende tijdelijke oplossing zou zijn om session.use_strict_mode in te schakelen. Beveiligingsexpert Kevin Beaumont meldt dat de Linux-kernelbeveiligingsmodule AppArmor of SELinux ook bescherming biedt tegen misbruik van deze grote PHP-kwetsbaarheden.

I understand the NL language
Translate this if you don't

Jump to the sources read and work

Sources:

https://jackalsyn.com/posts/php-up-2026.html

https://sansec.io/research/php2shell

https://tweakers.net/

#PHP #bug #serious #infoSEC #programming #upgrade

🚨 If you run PHP (like most of the internet does), this one can’t wait: #PHP2Shell = 2 critical RCE flaws in PHP core leaked before the patch, with live attacks already reported.

Because CVE-2026-109618 & CVE-2026-109619 sit in PHP itself, every app on a vulnerable PHP version is exposed, no matter what runs on top.

That’s why we’re building detection in our Network Scanner + an exploit module in Sniper as you’re reading this. Stay tuned for the launch announcement!

What to do now:

Inventory every PHP install, including control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
Patch as soon as PHP’s release is out, then restart PHP-FPM or your web server
On PHP 8.1 or older? No fix is coming. Upgrade, or take those systems off the internet
Alert on PHP processes spawning shells, interpreters, or download tools

#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking

@thomasfuchs that's spooky. Remote-code execution 😬

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

> From what has been reported, the flaws are in how PHP processes file-upload requests. When a browser sends a form that contains a file, it uses a multipart/form-data request, which is a request body split into separate parts for each field and file. PHP reads and splits that body itself before your application code runs.

Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)
#CVE_2026_109618 #CVE_2026_109619
https://watchtowr.com/intelligence/php-cve-2026-109618-faq/

Critical PHP security vulnerabilities (CVE-2026-109618/-109619)

Our entire team is working on assessing the impact of the disclosed vulnerabilities and preparing to deploy the PHP patch, which is due to be released today at 4 pm.

Due to maintenance work, there may be some service interruptions. We apologise for any inconvenience caused.

Do you run your own systems using PHP? Please carry out the update to the new version as a matter of urgency today.

We will keep you informed.

Kritische PHP-Sicherheitslücken (CVE-2026-109618/-109619)

Unser gesamtes Team arbeitet an der Betroffenheitsanalyse der bekannt gewordenen Schwachstellen und bereitet das Einspielen des PHP-Patches vor, der heute um 16 Uhr erscheinen soll.

Aufgrund der Wartungsarbeiten kann es zu Unterbrechungen kommen. Wir bitten um Ihr Verständnis.

Betreiben Sie eigene Systeme mit PHP? Führen Sie heute dringend das Update auf die neue Version durch.

Wir halten Sie auf dem Laufenden.

@GossiTheDog Additional PoCs and write-ups, supposedly:

https://github.com/0x4148/CVE-2026-109618-php2shell-lab

https://github.com/syhunt/php2shell-protection

https://qideng.substack.com/p/php2shell-dissecting-phps-critical

🔧 Dočasně vypínáme podporu přes FreeScout (helpdesk.oscloud.cz) kvůli kritické chybě v PHP. Znovu ji zapneme po aplikování opravy.

⚠️ Kritická zranitelnost v PHP, co to znamená pro OSCloud

PHP tým oznámil dvě kritické chyby (CVE-2026-109618 a CVE-2026-109619, obě CVSS 9.2). Mohou umožnit spuštění cizího kódu na serveru bez přihlášení. Oprava vychází dnes v 16:00 SEČ/CEST. Podle hlášení bezpečnostních firem už probíhají první útoky.

Kterých služeb se to týká:
• Nextcloud, WordPress, Pixelfed, FreeScout, a další aplikace postavené na PHP
• LAMP weby zákazníků (Apache + PHP), včetně těch, kde zatím běží jen úvodní stránka

Kterých ne:
• Mastodon, Matrix, PeerTube, Gitea (PHP nepoužívají)
• Weby a úložiště na statických souborech (Surfer)

Co děláme:
• FreeScout jsme vypnuli
• Další PHP aplikace a LAMP weby budeme vypínat postupně a vždy o tom budeme informovat zde. Počítejte s tím, že dočasně vypneme i Nextcloud, a to do vydání a nasazení opravy
• Jakmile budou dostupné opravené verze aplikací, nasadíme je co nejdřív
• Před vypnutím a updaty děláme zálohy

Co to znamená pro vás:
• Podpora přes FreeScout je do opravy nedostupná
• Nextcloud, LAMP weby a další PHP služby mohou být dnes nedostupné
• Pokud by se při updatu něco pokazilo, vracíme se ze zálohy maximálně 12 hodin zpět

Opravu nelze řešit pluginy ani updatem WordPressu, musí přijít nové PHP v rámci aktualizace aplikace. Pokud provozujete vlastní PHP web mimo OSCloud, aktualizujte PHP hned, jak vyjde oprava.

Děkujeme za trpělivost. Stav budeme průběžně aktualizovat v tomto vlákně.

#OSCloud #PHP #Bezpečnost

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) https://isc.sans.edu/diary/33440

⚠️PHP2Shell: Kritische PHP-Lücken CVE-2026-109618/109619⚠️

Zwei kritische PHP-Sicherheitslücken („PHP2Shell“) wurden am 20. Oktober vor Ablauf der Sperrfrist öffentlich. Das PHP-Team hat die Patch-Veröffentlichung daraufhin vorgezogen. (16:00MEZ).

Betroffen ist praktisch jede PHP-Website: #WordPress, #WooCommerce, #Drupal, #Joomla, #Magento. Das geleakte Exploit-Tool nennt PHP ab 5.4.0; offizielle Fixes unterstüzen nur PHP 8.2 bis 8.5 .

#php #php2shell #kritischelücke #sicherheit

Milhões de servidores PHP expostos ao risco da falha PHP2Shell. A recente divulgação de detalhes técnicos sobre as vulnerabilidades críticas no PHP (CVE-2026-109618 e CVE-2026-109619) acendeu os alertas no setor. 🚨

🔗 https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell

#apache #dados #equipa #falha #risco 

uh oh, 5, too many https://kb.isc.org/docs/cve-2026-94300

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-94300/

"No way to prevent this" say u...

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-94300/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

ISC fixes four BIND 9 vulnerabilities, including CVE-2026-94300 memory corruption and denial of service bugs. Upgrade to BIND 9.20.30 or 9.21.27.

#BIND9 #ISC #DNS #CVE202694300 #CVE202619630 #CVE202697313 #DenialOfService #CyberSecurity

https://securityonline.info/bind-9-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-114403: PHPOffice PHPPresentation ≤1.2.0 faces CRITICAL insecure deserialization (CVSS 9.2). Remote code execution & DoS possible via crafted uploads. No patch; avoid untrusted inputs. Details: https://radar.offseq.com/threat/cve-2026-114403-deserialization-of-untrusted-data-in-phpoffice-phppresentation-21b2eb9e24a6b900 #OffSeq #CVE2026114403 #PHP #AppSec

Upgrade to Apache bRPC 1.18.0 to patch 35 Apache bRPC vulnerabilities, including high-severity flaws CVE-2026-48830 and CVE-2026-56388.

#ApachebRPC #Apache #RPC #Cybersecurity #Vulnerability #OpenSource #InfoSec

http://securityonline.info/apache-brpc-vulnerabilities-patched-1-18-0/?utm_source=mastodon&utm_medium=jetpack_social

Upgrade to Apache bRPC 1.18.0 to patch 35 Apache bRPC vulnerabilities, including high-severity flaws CVE-2026-48830 and CVE-2026-56388.

#ApachebRPC #Apache #RPC #Cybersecurity #Vulnerability #OpenSource #InfoSec

http://securityonline.info/apache-brpc-vulnerabilities-patched-1-18-0/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-87095: A CRITICAL auth bypass in Acronis Cyber Infrastructure (pre-6.0.1-112/6.1.1-64/6.2.1-71) risks data disclosure & tampering (CVSS 9.1). No patch confirmed. Limit network access & monitor logs. https://radar.offseq.com/threat/cve-2026-87095-cwe-863-in-acronis-acronis-cyber-infrastructure-10e3c7d3d7e8e2e5 #OffSeq #CVE #Acronis #Vuln #BlueTeam

Upgrade to Apache bRPC 1.18.0 to patch 35 Apache bRPC vulnerabilities, including high-severity flaws CVE-2026-48830 and CVE-2026-56388.

#ApachebRPC #Apache #RPC #Cybersecurity #Vulnerability #OpenSource #InfoSec

http://securityonline.info/apache-brpc-vulnerabilities-patched-1-18-0/?utm_source=mastodon&utm_medium=jetpack_social

Upgrade to Apache bRPC 1.18.0 to patch 35 Apache bRPC vulnerabilities, including high-severity flaws CVE-2026-48830 and CVE-2026-56388.

#ApachebRPC #Apache #RPC #Cybersecurity #Vulnerability #OpenSource #InfoSec

http://securityonline.info/apache-brpc-vulnerabilities-patched-1-18-0/?utm_source=mastodon&utm_medium=jetpack_social

New advisory from Fortinet for a medium-severity bug:

CVE-2025-66178: FortiWeb improper neutralization of special elements used in an OS command vulnerability https://app.opencve.io/cve/CVE-2025-66178

Yesterday:

CRITICAL: CVE-2026-106173: improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 https://app.opencve.io/cve/CVE-2026-106173 #Fortinet #infosec #vulnerability

Update the Duplicator WordPress plugin to 5.0.0 to fix CVE-2026-82814, a high-severity PHP Object Injection flaw risking RCE and site takeover.

#WordPress #Duplicator #PHPObjectInjection #Wordfence #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/duplicator-wordpress-plugin-php-object-injection/?utm_source=mastodon&utm_medium=jetpack_social

Update the Duplicator WordPress plugin to 5.0.0 to fix CVE-2026-82814, a high-severity PHP Object Injection flaw risking RCE and site takeover.

#WordPress #Duplicator #PHPObjectInjection #Wordfence #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/duplicator-wordpress-plugin-php-object-injection/?utm_source=mastodon&utm_medium=jetpack_social

🏆 New Achievement! Plex2Shell Shocked!

We gather here today to mourn Plex Media Server, which served your terrible taste in movies faithfully until three vulnerabilities — CVE-2026-96652, CVE-2026-96651, and CVE-2026-96656 — formed the Plex2Shell chain and took it down. Researcher Zach Main disclosed these flaws on July 27th. A patch shipped August 3rd. (1/3)

🏆 New Achievement! Plex2Shell Shocked!

We gather here today to mourn Plex Media Server, which served your terrible taste in movies faithfully until three vulnerabilities — CVE-2026-96652, CVE-2026-96651, and CVE-2026-96656 — formed the Plex2Shell chain and took it down. Researcher Zach Main disclosed these flaws on July 27th. A patch shipped August 3rd. (1/3)

Details and a PoC are public for CVE-2026-113380, a Signal call vulnerability in RingRTC that keeps calls live after hang-up. Update now.

#Signal #RingRTC #CVE2026113380 #Privacy #PoC #MobileSecurity #Eavesdropping #CyberSecurity

https://securityonline.info/signal-call-vulnerability-ringrtc-poc/?utm_source=mastodon&utm_medium=jetpack_social

Details and a PoC are public for CVE-2026-113380, a Signal call vulnerability in RingRTC that keeps calls live after hang-up. Update now.

#Signal #RingRTC #CVE2026113380 #Privacy #PoC #MobileSecurity #Eavesdropping #CyberSecurity

https://securityonline.info/signal-call-vulnerability-ringrtc-poc/?utm_source=mastodon&utm_medium=jetpack_social

#Signal bug could keep your mic - and camera - on after hangup
The #vulnerability, CVE-2026-113380, was published by MITRE on Tuesday and given a CVSS score of 9.3, marking it as a critical issue in Signal’s open-source #RingRTC library in every single version before 2.72.0. That update was pushed out last month, but the vulnerability wasn’t made public until now.
Careful what you say after goodbye, or better yet, update your messaging app.
https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528

Signal fixed critical RingRTC flaw CVE-2026-113380, which could leave audio—and possibly video—active after hangup. The fix is in RingRTC 2.72.0; Signal users should update their apps. 🔒📞 #Signal #Cybersecurity https://cyberinsider.com/signal-fixes-critical-flaw-that-could-keep-audio-active-after-hangup/

New advisory from Fortinet for a medium-severity bug:

CVE-2025-66178: FortiWeb improper neutralization of special elements used in an OS command vulnerability https://app.opencve.io/cve/CVE-2025-66178

Yesterday:

CRITICAL: CVE-2026-106173: improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 https://app.opencve.io/cve/CVE-2026-106173 #Fortinet #infosec #vulnerability

🚨 Critical GitLab flaw allows unauthenticated attackers to execute code on servers

GitLab has patched CVE-2026-97229, a maximum-severity vulnerability affecting Community Edition and Enterprise Edition.
⠀
The integer overflow flaw exists in GitLab’s CI/CD regular expression compiler. Under certain conditions, an attacker can execute arbitrary code on a GitLab server by placing a specially crafted regular expression in a CI/CD configuration.

No authentication or user interaction is required.
⠀
Key details:

• CVSS score: 10.0
• Network-accessible
• No privileges required
• Affects GitLab 19.2 before 19.2.8
• Affects GitLab 19.3 before 19.3.5
• Affects GitLab 19.4 before 19.4.2
⠀
GitLab.com and GitLab Dedicated environments have already been patched. Administrators running self-managed installations should update immediately.

Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell

Bulletin ID: 2026-132-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/09/2026 08:30 AM PDT
Description:
AWS Tools for PowerShell V5 lets developers and administrators manage their AWS services fr...

https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/

#aws #security

@Laukidh psst:

pro fix CVE-2026-80521 --dry-run

@Laukidh psst:

pro fix CVE-2026-80521 --dry-run

🏆 New Achievement! Plex2Shell Shocked!

We gather here today to mourn Plex Media Server, which served your terrible taste in movies faithfully until three vulnerabilities — CVE-2026-96652, CVE-2026-96651, and CVE-2026-96656 — formed the Plex2Shell chain and took it down. Researcher Zach Main disclosed these flaws on July 27th. A patch shipped August 3rd. (1/3)

CVE-2026-94144 SQLi in Drogon ORM makeCriteria, CVSS 7.3, unpatched and exploit published. Filter input reaches SQL remotely. Vendor silent, so audit your ORM calls now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94144/

CVE-2026-94148 ScadaBR info disclosure via Export Project endpoint, CVSS 5.3. Exploit public, remote. Patch still under review, upgrade to 1.2.0 advised. Stay on it. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94148/

CVE-2026-65652: Temporal TChannel Go remote DoS, CVSS N/A. Unvalidated checksum type triggers a panic that kills the host process. Patch is still under review, so restrict listener exposure until it lands: #CVE #infosec #Temporal https://www.valtersit.com/cve/CVE-2026-65652/

Oracle fixed 98 MySQL vulnerabilities in October 2026, including CVSS 9.8 bugs CVE-2025-15467 in OpenSSL and CVE-2026-9547 in curl.

#MySQL #Oracle #CVE202515467 #CVE20269547 #DatabaseSecurity

https://securityonline.info/oracle-mysql-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Oracle fixed 98 MySQL vulnerabilities in October 2026, including CVSS 9.8 bugs CVE-2025-15467 in OpenSSL and CVE-2026-9547 in curl.

#MySQL #Oracle #CVE202515467 #CVE20269547 #DatabaseSecurity

https://securityonline.info/oracle-mysql-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Oracle fixed 98 MySQL vulnerabilities in October 2026, including CVSS 9.8 bugs CVE-2025-15467 in OpenSSL and CVE-2026-9547 in curl.

#MySQL #Oracle #CVE202515467 #CVE20269547 #DatabaseSecurity

https://securityonline.info/oracle-mysql-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Oracle fixed 98 MySQL vulnerabilities in October 2026, including CVSS 9.8 bugs CVE-2025-15467 in OpenSSL and CVE-2026-9547 in curl.

#MySQL #Oracle #CVE202515467 #CVE20269547 #DatabaseSecurity

https://securityonline.info/oracle-mysql-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Plex Media Server is being widely exploited: a four-bug chain gives remote code execution on servers older than 1.43.3.10861. CISA added it to KEV Oct 20. Update now and check the Codecs folder.

Also: PAN-OS GlobalProtect CVE-2026-0257 (ransomware, patch now), and EOL D-Link NAS and UniFi Video boxes hijacked for bandwidth. Retire them.

Free Wednesday email:
https://patchorpass.beehiiv.com/?utm_source=mastodon&utm_medium=social&utm_campaign=issue1

#infosec #homelab #selfhosted #plex

CVE-2026-0257 affects PAN-OS GlobalProtect portals and gateways, potentially allowing attackers to bypass security restrictions and establish an unauthorized VPN connection. https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226

the original post mentions CVE-2025-64702 for quic-go, but note that CVE-2026-40898 (June 2026) for HTTP trailers, from June 2026, was very similar and only patched in quic-go v0.59.1

caddy uses quic-go. recent caddy versions (eg, my PDS is running v2.11.7) have been patched for a while.

CVE-2025-54068 : Deep Dive Into Livewire, From Weak Typing To Pre-Authenticated Remote Command Execution - Rémi Matasse
#HackLu @hack_lu
https://youtu.be/zPW_lNbYy1M

What the PHP2Shell rumors got wrong, from inside the PHP security team https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

the original post mentions CVE-2025-64702 for quic-go, but note that CVE-2026-40898 (June 2026) for HTTP trailers, from June 2026, was very similar and only patched in quic-go v0.59.1

caddy uses quic-go. recent caddy versions (eg, my PDS is running v2.11.7) have been patched for a while.

CVE-2026-114509: Laravel TokenGuard auth bypass (CRITICAL, CVSS 9.2) impacts <12.68.0 & 13.0.0 – 13.29.0. Exploit allows account takeover via crafted credentials. Upgrade to 12.68.0/13.29.0+ now! https://radar.offseq.com/threat/cve-2026-114509-cwe-287-improper-authentication-in-laravel-framework-e0bd04cb5db6dac1 #OffSeq #Laravel #Infosec #CVE2026114509

CVE-2026-114509: Laravel TokenGuard auth bypass (CRITICAL, CVSS 9.2) impacts <12.68.0 & 13.0.0 – 13.29.0. Exploit allows account takeover via crafted credentials. Upgrade to 12.68.0/13.29.0+ now! https://radar.offseq.com/threat/cve-2026-114509-cwe-287-improper-authentication-in-laravel-framework-e0bd04cb5db6dac1 #OffSeq #Laravel #Infosec #CVE2026114509

NOT NOW, GITLAB AND NODEJS.

CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler => RCE
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee

CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits RCE
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

@Viss sorry direct link to the RCE CVE

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-111497/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-111497/

"No way to prevent this" say u...

The Node.js security release fixes 10 flaws, including a Brotli remote code execution bug, CVE-2026-111497. Update to 26.12.1, 24.22.1 or 22.23.4.

#NodeJS #CVE2026111497 #CVE2026105483 #CVE2026106069 #RemoteCodeExecution #TLS #JavaScript #CyberSecurity

https://securityonline.info/nodejs-security-release-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Node.js Brotli decoder out-of-bounds write permits remote code execution

(CVE-2026-111497) - (high)

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high

Why nobody is freaking out about this one?

@gsuberland Does CVE-2026-99999 from a few days ago count?

Too many pessimists among our system administrators and software engineers regarding CVE-2026-99999.

Look on the bright side! At least you know it's the last CVE of the year, and you can relax.

#CVE #PHP #four #TLS #CVE202699999 #sarcasm #sysadmin #ReplyGuy #DontReplyGuyMe

@douglasvb @fname Don't lose track of CVE-2026-99999 either 🫠

🚨 PwnEscape (CVE-2026-99999), a critical Linux kernel flaw, could let malicious VMs escape KVM isolation and compromise hosts. Admins should patch and plan for a reboot; researchers warn exploits may emerge within weeks. 🔒 #Linux #Cybersecurity https://www.heise.de/en/news/PwnEscape-Critical-Linux-kernel-flaw-allows-VM-escape-11492399.html

CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bounds heap writes https://lobste.rs/s/dldfel #c #security
https://www.openwall.com/lists/oss-security/2026/10/21/18

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-107891/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-107891/

"No way to prevent this" say u...

As an issue that can lead to writes outside of an allocated object, overflowing into other objects on the heap, CVE-2026-107891 should be taken with appropriate seriousness.

However, as far as we know at this time, without concurrent accesses from another thread to objects which might be stomped during regcomp, or unsafe SIGSEGV handler code, a predictable crash should happen before any further code runs that could use the clobbered objects in a way yielding control over the flow of execution to an attacker.

SECURITY ADVISORY: musl libc up through 1.2.6 (present version) is affected by integer overflows in regcomp (regular expression handling) leading to insufficient allocation of heap-based buffers for the compiled regex data structures.

CVE-2026-107891 has been assigned for this issue.

https://www.openwall.com/lists/musl/2026/10/21/1

🚨 JUST IN: Announcing rustup 1.29.2

> Rustup 1.29.2 is a small security release that updates dependencies to fix the eMudhra intermediate certificate issue (CVE-2026-111943). Update with rustup self update.

@q3k and also

> TLS certificate hostname bypass when the host loosely resolves to an IP address (CVE-2026-106069) - (high)

???

> TLS certificate hostname bypass when the IP is written fullwidth digits (CVE-2026-105483) - (high)

what a week