Vulnerability (CVE)
PHP plans to release a fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out of 10, and has issued no workaround of its own. The session.upload_progress.enabled=0 setting that spread on social media was walked back by the firm that suggested it,...
PHP released emergency updates in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for two critical runtime flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 on CVSS v4.0, that let an unauthenticated attacker run code on a web server. The flaws...
PHP scheduled an out-of-cycle security release for 14:00 UTC on October 21 covering two critical remote code execution vulnerabilities its team rated 9.2 on CVSS v4.0, with fixes limited to the supported 8.2 through 8.5 branches. The notice followed an...
PHP published an informational advisory on October 23 warning of CVE-2026-115560, a new remote code execution path that affects only applications that set session.serialize_handler to php_binary or php_serialize, switch it to php via ini_set() at runtime,...
Amazon's Threat Intelligence team detected an attempt to exploit the PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot, four days before the flaws were publicly disclosed, originating from IP address 103.216.220[.]92, geolocated to...
Attackers have been attempting, so far unsuccessfully, to exploit the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2, unauthenticated RCE via crafted HTTP requests) to deploy a Mirai variant called Potassium, with Cloudflare observing tens...
The PHP Foundation released patches for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, codenamed PHP2Shell, that could lead to unauthenticated remote code execution. Cloudflare said it detected millions of exploitation attempts...