Skip to content

27 results for “PHP”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types122Articles56Advisories27Write-ups19Repos7Threads7
Talks4Other1Tools1
🚨 Advisories“PHP”Clear all
unit42.paloaltonetworks.comadvisory🛡️ Security

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

Unit 42 threat brief on PHP2Shell, two PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0 9.2), both caused by longjmp() error handling that leaves memory uninitialized or freed. Cortex Xpanse counted over 22.6 million exposed instances. The 29 October 2026 update says attackers chained PHP2Shell with a Linux kernel privilege escalation against internet-exposed PAN-OS management interfaces. An earlier 23 October claim of post-compromise activity was retracted on 25 October.

PHPPAN-OSLinux kernel+2
CVE-2026-109618CVE-2026-109619PHP2Shell+2

Threat Intel, AppSec· Added 30 Oct 2026, published 29 Oct 2026

cisa.govadvisory🛡️ Security

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog on 26 October 2026: CVE-2026-109618 (memory corruption) and CVE-2026-109619 (stale internal request state). It also updated its PHP alert on critical vulnerabilities requiring immediate patching. The alert restates BOD 26-04, which requires federal civilian agencies to prioritize fast remediation of KEV CVEs on exposed assets and to check for prior compromise.

PHPCISA KEV
CVE-2026-109618CVE-2026-109619BOD 26-04+1

AppSec, GRC· Added 29 Oct 2026, published 26 Oct 2026

cisa.govadvisory🛡️ Security

CISA: Critical Vulnerabilities in PHP Require Immediate Patching

CISA alert on CVE-2026-109618 and CVE-2026-109619 ("php2shell"), unauthenticated remote code execution flaws affecting PHP installations serving web requests, including mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updated 23 October 2026 with a Sigma rule, partner advisories (NSA, NCSC-UK, ASD ACSC, NCSC-NL, NCSC-NZ, Cyber Centre) and guidance to inventory PHP, patch internet-facing systems first, and watch for PHP workers spawning shells. No in-the-wild exploitation had been observed.

PHPApachePHP-FPM+3
CVE-2026-109618CVE-2026-109619PHP2Shell+2

AppSec, Blue Team & Detection· Added 24 Oct 2026

horizon3.aiadvisory🛡️ Security

CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, critical unauthenticated RCE flaws in PHP core fixed on 21 October 2026 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The page explains the out-of-memory corruption and stale global state causes, mod_php and PHP-FPM exposure, interim mitigations, hunting guidance, exploitation reports from October 2026, and the 23 October CVE-2026-115560 upload-progress advisory. Horizon3 also announced a non-exploiting NodeZero check.

PHPPHP-FPMApache+3
CVE-2026-109618CVE-2026-109619CVE-2026-115560+5

AppSec, Blue Team & Detection· Added 29 Oct 2026, published 23 Oct 2026

x.comadvisory🛡️ Security

Xavier Rivera (@XavierRiveraX) on X

CVE-2026-115560 is a PHP code execution bug reported two days after the PHP2Shell emergency patches. The post says those releases do not fix it and no emergency fix is planned. Only apps that switch session.serialize_handler to php via ini_set() before session_start() are exposed. The mitigation is session.upload_progress.enabled=0, which also covers anyone who applied it for the 21 October advisory. The post gives no technical root-cause detail.

PHP
CVE-2026-115560PHP2Shell

AppSec· Added 25 Oct 2026, published 23 Oct 2026

snyk.ioadvisory🛡️ Security

PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now

Snyk's write-up of two critical unauthenticated PHP runtime RCEs, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state, cross-request use-after-free), both CVSS v4.0 9.2. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. It covers the disclosure timeline, affected SAPIs (mod_php most exposed), backports for 8.1 and older, and partial mitigations.

PHPApacheFrankenPHP+3
CVE-2026-109618CVE-2026-109619SNYK-UNMANAGED-PHP-21347795+2

AppSec· Published and added 22 Oct 2026

aws.amazon.comadvisory🛡️ Security

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

AWS bulletin 2026-143-AWS covers CVE-2026-109618 and CVE-2026-109619, critical PHP web runtime flaws that let an unauthenticated remote caller run code, read process data or cause denial of service. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 5.4 to 8.1 get no fix. It gives status for WorkMail, Elastic Beanstalk, Amazon Linux and Lightsail, plus AWS WAF rules, including a custom "PHP2Shell" rule matching PHP_SESSION_UPLOAD_PROGRESS and PHPSESSID.

PHPAWSAWS WAF+3
CVE-2026-109618CVE-2026-109619PHP2Shell+1

AppSec, Cloud & Infra· Added 22 Oct 2026, published 21 Oct 2026

endorlabs.comadvisory🛡️ Security

PHP2Shell: Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) | Endor Labs

PHP2Shell is the name for two critical PHP core memory-safety flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. Fixes ship in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Wiz researchers demonstrated RCE against WordPress, Drupal and Joomla, and Apache with mod_php is the highest risk. The post covers inventory, container rebuilds, Cloudflare WAF rules and temporary exposure reduction.

PHPWordPressDrupal+3
CVE-2026-109618CVE-2026-109619PHP2Shell+4

AppSec, DevSecOps· Published and added 21 Oct 2026

blog.talosintelligence.comadvisory🛡️ Security

Two critical RCEs in PHP core

Cisco Talos advisory on "php2shell", two unauthenticated RCE flaws in PHP core, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), affecting every build since PHP 5.4. One flaw is an out-of-memory handling bug leaving request data partly initialized; the other reuses stale state after free. PHP 8.1 and older get no patch (about 50% of PHP systems). Includes ini-level mitigations and Snort SIDs 67359 and 67360. No exploitation seen as of 21 October 2026.

PHPWordPressCVSS
CVE-2026-109618CVE-2026-109619php2shell+2

AppSec, Blue Team & Detection· Published and added 21 Oct 2026

watchtowr.comadvisory🛡️ Security

PHP Remote Code Execution ("PHP2Shell" CVE-2026-109618 & CVE-2026-109619)

PHP2Shell is the name for CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state), two unauthenticated PHP remote code execution flaws rated CVSS 4.0 9.2. Details leaked before the 21 October 2026 patch release, and watchTowr's honeypots saw exploitation. The page lists fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), states that .ini mitigations do not work, gives a timeline, and describes compromise checks.

PHPApacheFrankenPHP+2
CVE-2026-109618CVE-2026-109619PHP2Shell+3

AppSec, Threat Intel· Added 28 Oct 2026, published 21 Oct 2026

orca.securityadvisory🛡️ Security

Critical PHP “PHP2Shell” RCE Vulnerabilities Allow Unauthenticated Remote Code Execution (CVSS 9.2)

PHP2Shell is the informal name for CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), unauthenticated remote code execution flaws in the PHP core runtime. Patches for branches 8.2 to 8.5 were scheduled for 21 October at 14:00 UTC, while PHP 8.1 and older get no fix; about 884,000 internet-facing hosts run those versions. watchTowr reproduced CVE-2026-109618, no public PoC existed at writing, and Sansec expects mass exploitation within 15 minutes of release.

PHP
CVE-2026-109618CVE-2026-109619PHP2Shell+4

AppSec· Published and added 21 Oct 2026

github.comadvisory🛡️ Security

PHP 8.2.35

PHP 8.2.35 is a security release of the PHP 8.2 branch that fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. The notes say no complete mitigations exist and updating is the only safe choice. PHP 8.2 reaches end of life on 31 December 2026, after which it gets no security fixes.

PHP
CVE-2026-109618CVE-2026-109619

AppSec· Added 22 Oct 2026, published 21 Oct 2026

huntress.comadvisory🛡️ Security

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Huntress rapid-response post on php2shell, two leaked critical PHP core vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2 each) reported as remote code execution. The PHP team moved its security release to 21 October 2026, 14:00 UTC, after the leak. It lists hunting cues such as php-fpm, php-cgi or apache2 spawning shells, interpreters or download tools, plus inventory and patch steps. No root cause, affected versions, PoC or IOCs were public at writing.

PHPHuntressWordPress+2
CVE-2026-109618CVE-2026-109619php2shell+4

Blue Team & Detection, Threat Intel, AppSec· Published and added 21 Oct 2026

aikido.devadvisory🛡️ Security

Critical vulnerabilities in PHP (PHP2SHELL)

PHP2SHELL is Aikido Security's advance notice of two critical remote code execution flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2, with all versions treated as affected. The PHP security team will release fixes at 14:00 UTC on 21 October 2026, a day early after details leaked on 20 October. The post withholds exploitation details and workarounds.

PHPCVSS
CVE-2026-109618CVE-2026-109619PHP2SHELL+1

AppSec· Published and added 21 Oct 2026

news-web.php.netadvisory🛡️ Security

Upcoming Critical PHP Security Release

The PHP security team announces an upcoming PHP security release that fixes two critical vulnerabilities, both rated CVSS v4.0 9.2. The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. The team says it may release earlier if details become public or exploitation in the wild is seen. The notice gives no CVE IDs, affected versions or technical details.

PHPCVSS
PHP security team

AppSec· Added 21 Oct 2026, published 20 Oct 2026

watchtowr.comadvisory🛡️ Security

Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws in PHP, both CVSS v4.0 9.2. One stems from out-of-memory corruption during request setup, the other from stale global state reused by the next request. watchTowr reports exploitation since 21 October 2026, lists fixed releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) and says PHP 5 is also affected. PHP says no configuration change fully mitigates.

PHPApacheCVSS
CVE-2026-109618CVE-2026-109619PHP2Shell+3

AppSec, Threat Intel· Added 30 Oct 2026, published 20 Oct 2026

php.netadvisory🛡️ Security

Upcoming Critical PHP Security Release

The php.net 2026 news archive opens with the PHP security team's advance notice of a release scheduled for 21 October 2026 at 14:00 UTC. It fixes two critical vulnerabilities, both rated CVSS v4.0 9.2, and may ship earlier if details leak or exploitation appears. Details and fixed versions come with the release. The archive also lists 2026 security releases (8.2.34, 8.3.35, 8.4.26, 8.5.11), PHP 8.6 RC3 and conference announcements.

PHPCVSS
PHP 8.2.34PHP 8.3.35PHP 8.4.26+1

AppSec· Added 21 Oct 2026, published 20 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CyberForge CVE of the Day #074 analyses CVE-2026-85097, a CVSS 9.8 unauthenticated file upload to PHP execution flaw (CWE-434) in the Bricksforge WordPress plugin through 3.1.8.9. Wordfence names 3.1.8.10 as the fix, and a separate vendor 4.0.1 Pro Forms upload-security notice has no verified mapping to the CVE. It gives a defender workflow: scope versions, preserve edge/origin logs, inspect resulting files and PHP-FPM handling, and verify the patched version is serving. It also separates KEV (no match), EPSS (0.312%) and SSVC (exploitation none) from compromise evidence.

WordPressPHPCVSS+2
CVE-2026-85097CWE-434Wordfence+4

Blue Team & Detection, AppSec· Added 11 Oct 2026, published 10 Oct 2026

cisa.govadvisory🛡️ Security

CISA AA26-281A: Chinese Government-linked Actors Combine Automated and Hands-on Hacking Tools to Steal Data

Joint FBI/CISA/NSA and allied-agency advisory on China-linked actors enabled by Integrity Technology Group (overlapping with Flax Typhoon, Ethereal Panda, Red Juliett). It details their TTPs: open-source scanners and the MicroScan exploit-script app, an XSS credential-harvesting payload dropping live700_v1.exe, EBurst password spraying against Exchange/O365, SoftEther VPN persistence, DCSync via DC.exe, and email theft via the Curlc4.txt PHP bot and the office-cli utility. It also provides IOCs, MITRE ATT&CK mappings, CVEs, incident response steps, and mitigations.

SoftEtherMicrosoft 365Active Directory+3
Integrity Technology GroupFlax TyphoonEthereal Panda+13

Threat Intel, Blue Team & Detection· Added 9 Oct 2026

unit42.paloaltonetworks.comadvisory🛡️ Security

Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)

Unit 42 threat brief on CVE-2026-88771 (unauthenticated command injection) and CVE-2026-88772 (DTLS memory overflow) in NetScaler ADC and Gateway, both CVSS v4.0 9.5 and exploited as zero-days from August 2026. It details version fingerprinting, .deb and PHP web shells, a three-stage log-poisoning chain through ns_monuploadd_err.pl, httpd.conf persistence, IOCs, and 50,277 exposed instances as of 27 September 2026.

Citrix NetScalerPHPApache+2
CVE-2026-88771CVE-2026-88772CVE-2026-88773+9

Threat Intel, Blue Team & Detection· Added 30 Oct 2026, published 30 Sep 2026

thehackernews.comadvisory🛡️ Security

Attackers Exploit WordPress CVE-2026-87902 Within Hours of Patch

CVE-2026-87902 (CVSS 9.2) is an unauthenticated WordPress vulnerability where get_page_template() page-template resolution can be tricked into including an attacker-chosen local .php file outside the active theme directory, leading to RCE when a theme has a page-* top-level directory and a readable local PHP file (e.g. pearcmd.php) exists. Attackers began exploiting it within hours of the September 22, 2026 patch, including pearcmd.php to write PHP web shells to /tmp and /var/tmp and pulling a GitHub-hosted uploader payload, per honeypot telemetry from Previdian and Patchstack with tracked source IPs. CISA added the flaw to its KEV catalog on September 25, 2026, mandating FCEB remediation by September 28; fixed in WordPress 7.1.2, 7.0.6, 6.9.9, and 6.8.10.

WordPressPHPGitHub
CVE-2026-87902CISA KEVpearcmd.php+7

AppSec, Threat Intel· Added 26 Sep 2026

orca.securityadvisory🛡️ Security

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

CVE-2026-93485 (CVSS 7.1) is a stored XSS-to-RCE chain in WordPress Core's wpautop() function (wp-includes/formatting.php), where a mismatch between comment sanitization at save time and HTML reformatting at display time lets an unauthenticated attacker inject live event handlers via a crafted comment. When a logged-in administrator views the page, the script executes and installs a malicious plugin containing a web shell, achieving full RCE. It affects WordPress Core 4.7 through 7.1.0 (essentially all installs, including block themes since Twenty Twenty-Two), and is fixed in 7.1.1 with backports down to 4.7.36; no public PoC or in-the-wild exploitation was reported at disclosure time.

WordPressPHP
CVE-2026-93485

AppSec· Published and added 22 Sep 2026

wordpress.orgadvisory🛡️ Security

WordPress 7.1.2 Release (CVE-2026-87902 path-traversal RCE fix)

WordPress 7.1.2 patches CVE-2026-87902 (GHSA-7hp8-65ch-5whp), a critical unauthenticated path-traversal flaw where page template resolution can be manipulated to include an attacker-chosen readable local PHP file outside the active theme directory. Under certain server and active-theme preconditions this local file inclusion escalates to remote code execution. The security fix was backported to all WordPress branches back to 4.7; discovery credited to researcher Robert Ressl.

WordPressPHP
CVE-2026-87902GHSA-7hp8-65ch-5whppath traversal+2

AppSec· Added 28 Sep 2026, published 22 Sep 2026

orca.securityadvisory🛡️ Security

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites

CVE-2026-32475 (CVSS 9.0) is an unauthenticated arbitrary file upload leading to RCE in Elementor Pro's Forms module (versions up to 4.2.1), caused by the extension-blocklist check and the file-move step running in two separate loops with different empty-file handling, letting a two-part file submission bypass the blocklist and drop a PHP webshell into the public wp-content/uploads/elementor/forms/ directory. The post also flags related WordPress core CVE-2026-65640 (CVSS 8.8, fixed in 7.0.4), an Author-level RCE via malicious PostScript upload requiring Imagick and Ghostscript. Fix: upgrade Elementor Pro to 4.2.2+ and WordPress core to 7.0.4, and audit the uploads/elementor/forms directory for planted PHP files.

WordPressPHPOrca Security+1
CVE-2026-32475CVE-2026-65640arbitrary file upload+1

AppSec· Added 3 Sep 2026, published 20 Aug 2026

orca.securityadvisory🛡️ Security

Orca: CVE-2026-45034 PhpSpreadsheet RCE Patch Bypass

Orca Security details CVE-2026-45034 (CVSS 9.8), a bypass of PhpSpreadsheet's File::prohibitWrappers() protection that was originally added to fix CVE-2026-34084. A crafted path with three or more slashes after the scheme (e.g. phar:///path/exploit.phar/dummy.csv) causes PHP's parse_url() to return false instead of a scheme string, skipping the is_string($scheme) check while PHP's stream layer still treats the path as a phar wrapper, enabling automatic phar deserialization via IOFactory::load() and full RCE on PHP 7.x (file-read primitive on PHP 8.x, with RCE restored if Phar::getMetadata() is later called). All 1.x versions through 1.30.4 are affected; PhpSpreadsheet 1.30.5 patches the issue, and the post recommends replacing parse_url()-based checks with str_contains($filename, '://') validation.

PHP
CVE-2026-45034CVE-2026-34084@everping+1

AppSec· Published and added 12 Jun 2026

aikido.devadvisory🛡️ Security

10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums

Aikido Security discovered an unauthenticated authentication bypass in phpBB (versions up to 3.3.16 and 4.0.0-a2) that lets an attacker forge a valid session for any user via a single HTTP request, since the member list is public by default. Admin account takeover exposes full read/write/delete access, though a separate ACP password check blocks direct RCE. Fixed in phpBB 3.3.17, disclosed via HackerOne with a 4-day patch turnaround; technical exploit details withheld pending upgrade adoption.

phpBB
Aikido AttackHackerOneSanty worm

AppSec· Added 3 Sep 2026, published 10 Jun 2026

socket.devadvisory🛡️ Security

Socket: Packagist Urges Immediate Composer Update After GitHub Actions Token Leak

Packagist disclosed that Composer versions prior to 2.9.8, 2.2.28 LTS, and 1.10.28 could leak full GitHub Actions GITHUB_TOKEN and GitHub App installation token values into CI logs when a token failed Composer's outdated validation regex, triggered by GitHub's since-rolled-back rollout of a new hyphenated token format. Common setups like shivammathur/setup-php that auto-register GITHUB_TOKEN into Composer's global auth.json are called out as at risk, and teams are urged to update Composer immediately and audit Actions logs for exposed credentials.

ComposerGitHub ActionsPackagist+1
shivammathur/setup-phpGITHUB_TOKEN

DevSecOps, Supply Chain· Published and added 13 May 2026