VulnerabilitiesBrief2 min read
PHP's security team rated two undisclosed vulnerabilities 9.2 on the CVSS v4.0 scale. watchTowr researchers say both allow remote code execution, and only the four supported branches can get the fix.
VulnerabilitiesExploitedCVE-2026-109618CVSS 9.21 min read
The PHP security team published workaround advice for a new remote code execution flaw that has no patch, and said the earlier PHP2Shell bugs are already being probed in the wild.
ResearchBrief1 min read
Bojan Zdrnja walks through the published proofs of concept and finds heavy preconditions, including a small memory limit and a single-worker setup, that real servers rarely match.
IncidentsBrief2 min read
Some version 3.0.123 packages carried malware that could hand attackers control of a site once the plugin was activated, Rank Math says.
VulnerabilitiesBrief3 min read
A JSON array sent as the api_token let unauthenticated attackers log in as existing users on Laravel apps backed by MySQL or MariaDB, and a working proof-of-concept is public.
VulnerabilitiesExploitedCVE-2026-109618CVSS 9.22 min read
The PHP security team said it would ship emergency updates for two vulnerabilities rated 9.2 under CVSS v4.0, after details reportedly leaked ahead of the planned disclosure.
VulnerabilitiesExploitedCVE-2026-109618CVSS 9.22 min read
PHP says fixes for the two critical-severity bugs, publicly dubbed PHP2Shell, are planned for Wednesday, 21 October 2026 at 14:00 UTC, and urges users to prepare to upgrade immediately.
