[VDE-2026-152] The Weidmueller security routers IE-SR-4TX and IE-SR-4GT in firmware releases prior to 2.3.4 bundle a PHP version that is affected by CVE-2026-109618. In the configuration used by the products, the vulnerability can allow an attacker to cause a denial of service by making the web interface temporarily unavailable. All other functions (Routing, Firewall etc.) are not affected. It is fixed in firmware 2.3.4. CVE-2026-109619, which was published together with CVE-2026-109618, does…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]
Dalle attività di monitoraggio del CSIRT Italia e dall'analisi dell'esposizione nazionale emerge che l'81,9% dei servizi PHP con versione identificata risulta potenzialmente vulnerabile a PHP2Shell. Si sollecita l'aggiornamento immediato e la disabilitazione di session.upload_progress.enabled per la CVE-2026-115560, ancora priva di patch. Ove disponibili regole specifiche, configurare i WAF in modalità blocco; in assenza di mitigazioni efficaci, valutare di porre offline i servizi.
Classification: Severe, Solution: Workaround, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-115560, Summary: Informational advisory: Session upload progress We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further…
I veckans brev kan du läsa om de två kritiska sårbarheterna i programmeringsspråket PHP, som används av en mängd webbplatser över hela världen. Du hittar även en rapport från bland annat CISA om utpressningsaktören Safepay.
Welcome to this week’s edition of the Threat Source newsletter. Here for the latest on the PHP vulnerabilities? Head on down to ‘The One Big Thing’. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset. But if you want a bit of levity, here’s what I wrote before everything kicked off yesterday: Ever feel like the world is moving too fast to keep up? Well, I bring you scientific proof that it’s not just you.…
Serial Number: AV26-1070 Date: October 21, 2026 PHP security advisory (AV26-1070) As of October 21, 2026, PHP is affected by vulnerabilities in the following product: PHP Versions prior to 8.x The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Upcoming Critical PHP Security Release PHP Security Releases
Le 20 octobre 2026, PHP a publié une communication concernant deux vulnérabilités critiques. L'éditeur annonce la disponibilité des correctifs de sécurité pour le 21 octobre 2026 à 16h00 heure de Paris (14h00 UTC). Pour les versions de PHP 5.x, 6.x, 7.x, 8.0.x et 8.1.x , dont l'éditeur n'assure...
On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks. At this time, no technical details have been made public. CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available. The…
Classification: Important, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 7.5, CVEs: CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-17545, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682, Summary: PHP has released security updates addressing multiple vulnerabilities in PHP-FPM, OpenSSL, MySQLnd, Phar, SOAP, HTTP streams and Windows file handling. The most serious vulnerability allows an unauthenticated…