poslední zpráva
SPOJENO AI KEV ✓ (3 z 3) EPSS 1.00 (nejvyšší)
Check Point warns of zero-day flaw exploited for root access
Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October. [...]
Check Point VMware Siemens PHP Palo Alto Networks Weidmüller MB connect line Helmholz ads-tec Industrial IT Cisco Oracle NetApp Festo Apache WAGO Belden QNAP Synology Splunk ESET Welotec Juniper Networks HPE METTLER TOLEDO Citrix Cloud Software Group Tenable WordPress Drupal Joomla energetika výroba a průmysl školství US IT IL FR DE FI BE SK CZ CA RU NL AT SE HR GB
CVE v události 3
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-109618 | 9.2 4.0 · php | KEV ✓ | 1.00 |
| CVE-2026-109619 | 9.2 4.0 · php | KEV ✓ | 1.00 |
| CVE-2026-123039 | 7.8 3.1 · checkpoint | KEV ✓ | 0.01 |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 9.8.
Tahle CVE jsem vytáhl z širšího textu článku: CVE-2026-85102, CVE-2026-93616. Neukazuju u nich proto fakta z katalogů výše, a to preventivně, protože článek se na ně mohl jen odkazovat, třeba jako na starší kauzu.
Jak se o tom psalo 76
-
· BleepingComputer US
Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper
Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. [...]
-
· CSIRT Itálie (ACN) IT
Rilevate vulnerabilità in prodotti Check Point
Rilevate tre nuove vulnerabilità, di cui due con gravità “alta”, in vari prodotti Check Point. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di elevare i propri privilegi sui sistemi interessati. Tra queste si evidenzia la CVE-2026-123039, per la quale è stato rilevato lo sfruttamento attivo in rete.
-
· BleepingComputer US nadpis události
Check Point warns of zero-day flaw exploited for root access
Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October. [...]
-
· zachyceno · CISA KEV US
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2026-123039)
CISA added CVE-2026-123039 to the Known Exploited Vulnerabilities catalog. Affected product: Check Point Multiple Products. Remediation due date: 2026-11-16.
-
· Check Point Research IL
PHP2Shell Exploitation on Check Point Gateway
By Lotem Finkelstein, VP Research Key findings Beginning on 30 October 2026, an attacker executed scanning and exploitation activity against organizations with unpatched Check Point Security Gateways, using Mobile Access portals with PHP2Shell as initial access followed by CVE-2026-123039. The first wave, on October 30, targeted Israeli organizations and included destructive activity against some of them. A broader second wave on November 2 targeted organizations across multiple countries and…
-
· zachyceno · CISA Advisories US
Siemens Building Automation and Energy Products
View CSAF Summary On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products. As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices…
-
· zachyceno · CISA Advisories US
Siemens RUGGEDCOM APE1808
View CSAF Summary Palo Alto Networks has published information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. The following versions of Siemens RUGGEDCOM APE1808 are affected: RUGGEDCOM APE1808 vers:all/* (CVE-2026-109618, CVE-2026-109619) CVSS Vendor…
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans les produits Check Point (12 novembre 2026)
De multiples vulnérabilités ont été découvertes dans les produits Check Point. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
-
· CERT@VDE DE
Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT affected by PHP vulnerability
[VDE-2026-152] The Weidmueller security routers IE-SR-4TX and IE-SR-4GT in firmware releases prior to 2.3.4 bundle a PHP version that is affected by CVE-2026-109618. In the configuration used by the products, the vulnerability can allow an attacker to cause a denial of service by making the web interface temporarily unavailable. All other functions (Routing, Firewall etc.) are not affected. It is fixed in firmware 2.3.4. CVE-2026-109619, which was published together with CVE-2026-109618, does…
-
· CERT@VDE DE
MB connect line: php2shell in mbCONNECT24/mymbCONNECT24
[VDE-2026-128] MB connect line mbCONNECT24/mymbCONNECT24 ships with a bundled PHP version that is affected by two vulnerabilities known as "php2shell".
-
· CERT@VDE DE
Helmholz: php2shell in myREX24V2/myREX24V2.virtual
[VDE-2026-160] Helmholz myREX24V2/myREX24V2.virtual ships with a bundled PHP version that is affected by two vulnerabilities known as "php2shell".
-
· CERT@VDE DE
ads-tec Industrial IT: PHP Vulnerability in ADS-TEC IRF Products and Web Terminals
[VDE-2026-131] The ADS-TEC IRF1000 and IRF3000 products in firmware releases prior to 2.3.3, the IRF2000 products in firmware releases prior to 5.0.12 and the ADS-TEC web terminals DVG-SHW9019, DVG-SHW9024, DVG-MEW9016, DVG-MEW9019, DVG-MEW9024, DVG-OPW9016, DVG-OPW9019 and DVG-OPW9024 in AWT1000 software releases prior to 15.0.0 bundle a PHP version that is affected by CVE-2026-109618. In the configuration used by the products, the vulnerability allows a remote attacker to make the web…
-
· CSIRT Itálie (ACN) IT
Check Point: aggiornamenti e mitigazioni per le vulnerabilità "PHP2Shell"
Disponibili hotfix e misure di mitigazione per Check Point Firewall, Cloud Firewall, Security Gateway e Spark Firewall al fine di fronteggiare le vulnerabilità critiche note come "PHP2Shell" (CVE-2026-109618 e CVE-2026-109619), che interessano il componente PHP utilizzato dalle interfacce web di alcuni servizi esposti dai dispositivi.
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans les produits Cisco (06 novembre 2026)
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
-
· Qualys US
PHP2Shell on Windows and macOS: Automating the PHP Upgrade, With or Without an Agent
Executive Summary PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allows unauthenticated remote code execution on exposed PHP servers. PHP has released fixed versions. On Linux, distribution packages carry the fix. On Windows and macOS, they don’t: Microsoft and Apple don’t ship PHP, so the fix is an in-place PHP upgrade that has traditionally been done by hand, one server at a time. Qualys TruRisk Eliminate’s Custom Assessment and Remediation (CAR) capability runs Qualys TRU-published scripts…
-
· zachyceno · NCSC-FI FI
Oracle Security Alert Advisory CVE-2026-109618 and CVE-2026-109619
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-109618, CVE-2026-109619, Summary: This Security Alert addresses CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as PHP2Shell, allow for unauthenticated remote code execution in PHP. Oracle strongly recommends that customers apply the available security patches without delay. The Security Alert advisory will continue to be updated as additional product patches become…
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans NetApp ONTAP 9 (03 novembre 2026)
De multiples vulnérabilités ont été découvertes dans NetApp ONTAP 9. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
-
· CERT@VDE DE
Two critical PHP vulnerabilities in several Festo Didactic products
[FSA-202603] Festo Didactic FactoryViews and MES4 deployed along with xampp bundle an Apache web server with PHP. The bundled version of PHP is vulnerable to the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (commonly referred to as PHP2Shell). These vulnerabilities allow an attacker to remotely execute code on the FactoryViews or xampp host system.
-
· CERT@VDE DE
WAGO: Multiple Devices affected by PHP2Shell
[VDE-2026-132] Critical vulnerabilities in the PHP runtime may allow a remote attacker to execute arbitrary code by exploiting weaknesses in PHP's internal memory and request handling mechanisms. Under specific conditions, specially crafted web requests can trigger unexpected behavior that could compromise the affected web server process. WAGO controllers with the integrated web server enabled and running an affected PHP version are exposed to these vulnerabilities.
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans macmon et NRSW (02 novembre 2026)
De multiples vulnérabilités ont été découvertes dans Belden macmon et NRSW. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans Qnap QNE (02 novembre 2026)
De multiples vulnérabilités ont été découvertes dans Qnap QNE. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans les produits Synology (02 novembre 2026)
De multiples vulnérabilités ont été découvertes dans les produits Synology. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
-
· Cisco PSIRT US
Vulnerabilities in PHP Affecting Cisco Products: October 2026
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell. For information about Splunk products and offerings, see Vulnerabilities in PHP (CVE-2026-109618, CVE-2026…
-
· CSIRT Itálie (ACN) IT
ESET: aggiornamenti e mitigazioni per le vulnerabilità "PHP2Shell"
Disponibili aggiornamenti e misure di mitigazione per ESET Endpoint Encryption Server, piattaforma di gestione centralizzata delle funzionalità di cifratura offerte dalla suite ESET Endpoint Encryption, al fine di fronteggiare le vulnerabilità critiche note come "PHP2Shell" (CVE-2026-109618 e CVE-2026-109619) presenti nell'interprete PHP integrato nel prodotto.
-
· CERT@VDE DE
Welotec: PHP2Shell Vulnerabilities in SMART EMS
[VDE-2026-127] Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to and including v3.5.3 are affected. Exploitability and reliability depend on the PHP server interface, configuration, application behaviour, and worker reuse.
-
· zachyceno · NCSC-FI FI
2026-10 Reference Advisory: Status of PHP2Shell vulnerabilities on Juniper Products (CVE-2026-109618, CVE-2026-109619)
Classification: Critical, Solution: Workaround, Exploit Maturity: Not Defined, CVSSv4.0: 9.3, CVEs: CVE-2026-109618, CVE-2026-109619, Summary: The HPE Juniper Networking PSIRT is aware of the two PHP vulnerabilities leading to remote code execution, known as "PHP2Shell", and being tracked as CVE-2026-109618 and CVE-2026-109619. RCE via OOM corruption, CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then…
-
· CSIRT Itálie (ACN) IT
PHP2Shell: verificare i prodotti che Integrano PHP
Facendo seguito alle precedenti comunicazioni sulle vulnerabilità critiche note come “PHP2Shell”, si richiama l’attenzione sulla necessità di verificare sulle istanze dei propri servizi offerti la presenza di prodotti di terze parti che integrano PHP.
-
· CERT@VDE DE
METTLER TOLEDO: PHP2Shell in Octo Image Server
[VDE-2026-137] OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We strongly recommend to upgrade PHP to version 8.2.35.
-
· zachyceno · NCSC-FI FI
Citrix Security Advisory for CVE-2026-109618 and CVE-2026-109619
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.2, CVEs: CVE-2026-109618, CVE-2026-109619, Summary: Cloud Software Group is aware of the following vulnerabilities affecting PHP RCE via OOM corruption, CVE-2026-109618 RCE via stale global state, CVE-2026-109619 Impacted product: Citrix NetScaler ADC and Citrix NetScaler Gateway Cloud Software Group strongly urges customers of NetScaler ADC and NetScaler Gateway to install the following updated…
-
· GreyNoise Labs US
Global Event: PHP2SHELL Live Activity Report
GreyNoise is monitoring exploitation attempts against PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, colloquially known as 'php2shell'.
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans Palo Alto Networks PAN-OS (28 octobre 2026)
De multiples vulnérabilités ont été découvertes dans Palo Alto Networks PAN-OS. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance. Palo Alto Networks indique que les vulnérabilités CVE-2026-109618 et CVE-2026-109619 sont activement exploitées.
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway (27 octobre 2026)
De multiples vulnérabilités ont été découvertes dans Citrix NetScaler ADC et Gateway. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
-
· Aikido Security BE
How to patch PHP2Shell with free Aikido Images
Patch PHP2Shell (CVE-2026-109618 and CVE-2026-109619) with free Aikido Images for PHP 5.5 to 8.5. Stay on your current version with backported fixes. Category: Product Updates
-
· Tenable Research US
Discover and remediate PHP2Shell exposure with Tenable
Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster. Key takeaways The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) put security teams in a race against attackers. PHP runs on more than 70% of websites, so organizations need to quickly find where they’re affected and update PHP to fixed versions. Tenable helps you find PHP2Shell across your…
-
· ESET WeLiveSecurity SK
PHP2Shell: What to know about two critical PHP flaws
Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes
-
· BleepingComputer US
PHP2Shell security flaws now sucessfully exploited in the wild
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]
-
· Qualys US
Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own
PHP2Shell comes with a clear instruction: update PHP. Fixed releases exist for supported branches, and Qualys customers can identify PHP installations using network scans, Cloud Agents, container assessments, and Deep Scan where supported, while assessing exposed web applications and APIs with Qualys TotalAppSec. Patching at this scale still takes time. In Qualys telemetry, only 199,000 of the 156 million PHP package installations with a known version had been patched during the first 12 hours…
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans les produits Tenable (26 octobre 2026)
De multiples vulnérabilités ont été découvertes dans les produits Tenable. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
-
· CERT-FR – avis FR
Multiples vulnérabilités dans les produits Tenable (23 octobre 2026)
De multiples vulnérabilités ont été découvertes dans les produits Tenable. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans les produits Tenable (23 octobre 2026)
De multiples vulnérabilités ont été découvertes dans les produits Tenable. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
-
· Tenable Research US
The adversary economy: How threat actors are reacting to PHP2Shell
Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target. Key takeaways The adversary economy operates on the same fundamental principles as the legitimate economy. Forum self-evacuations: Criminal forums including BreachForums initiated emergency infrastructure migrations, taking themselves offline within hours of PHP2Shell disclosure,…
-
· BleepingComputer US
Amazon says PHP2Shell exploitation began 4 days before patches
Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. [...]
-
· CSIRT.CZ – novinky CZ
Kritické zranitelnosti PHP umožňují vzdálené spuštění kódu
Vývojový tým PHP zveřejnil bezpečnostní aktualizace, které opravují dvě kritické zranitelnosti v jádře jazyka PHP. Zranitelnosti CVE-2026-109618 a CVE-2026-109619 mohou za určitých podmínek umožnit neautentizovanému útočníkovi vzdálené spuštění libovolného kódu na zranitelném serveru. Problém se týká širokého spektra instalací PHP, které zpracovávají webové požadavky, včetně konfigurací PHP-FPM, Apache s modulem mod_php a dalších způsobů nasazení. Provozovatelům dotčených systémů doporučujeme…
-
· zachyceno · NCSC-FI FI
Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products
Classification: Critical, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 9.2, CVEs: CVE-2026-109618, CVE-2026-109619, Summary: Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out…
-
· zachyceno · NCSC-FI FI
PHP Security advisory: Critical remote code execution vulnerabilities
Classification: Critical, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 9.2, CVEs: CVE-2026-109618, CVE-2026-109619, Summary: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest…
-
· zachyceno · Splunk Advisories US
SVD-2026-1013: Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026
Splunk is investigating to determine which products may be affected by these vulnerabilities and the impact on each affected product. Currently, no products are known to be affected. This advisory will be updated as information is available.
-
· Cisco PSIRT US
Vulnerabilities in PHP Affecting Cisco Products: October 2026
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content…
-
· Cyber Centre Kanada CA
AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619
Number: AL26-026 Date: October 21, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Canadian…
-
· Malwarebytes Labs US
PHP2Shell: Why websites are going offline for emergency security updates
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched. The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10. Why this matters PHP is a programming language that works behind the…
-
· Securelist (Kaspersky) RU
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Vulnerability overview On October 20, 2026, the PHP security team published a preliminary notice regarding an upcoming emergency release that addresses two critical vulnerabilities (both rated 9.2 on the CVSS scale). The patches were released on Wednesday, October 21, 2026, at 14:00 UTC. The release was expedited after information about the vulnerabilities was leaked to the public before the scheduled embargo was lifted. In a post on Hacker News, a user reported two RCE vulnerabilities in PHP,…
-
· Cisco Talos US
Two critical RCEs in PHP core
Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial intelligence and associated technologies played a key role in the discovery of these vulnerabilities — yet another example of how these technologies are forcing change across the landscape…
-
· NÚKIB CZ
Upozornění na "php2shell", dvě kritické zranitelnosti v PHP
Upozorňujeme na dvojici zranitelností v PHP, označovaných jako "php2shell" (CVE-2026-109618 a CVE-2026-109619), které mohou vést ke vzdálenému spuštění kódu (RCE) bez nutnosti přihlášení. Zranitelnosti CVE-2026-109618: Při zpracování chyb způsobených nedostatkem paměti (OOM) prostřednictvím funkce longjmp() dochází kvůli nesprávnému řízení toku programu k ponechání paměti požadavku v neinicializovaném stavu. Útočník může cíleným vyvoláním stavu nedostatku paměti tuto nekonzistenci spolehlivě…
-
· CSIRT Itálie (ACN) IT
PHP2Shell: sanate vulnerabilità critiche in PHP
Aggiornamenti di sicurezza sanano 2 nuove vulnerabilità con gravità "critica" in PHP, noto interprete del linguaggio di scripting per lo sviluppo web. Tali vulnerabilità interessano la componente php-src e, qualora sfruttate, potrebbero permettere a un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi interessati.
-
· CSIRT Itálie (ACN) IT
PHP2Shell: sanate vulnerabilità critiche PHP
Aggiornamenti di sicurezza sanano 2 nuove vulnerabilità con gravità "critica" in PHP, noto interprete del linguaggio di scripting per lo sviluppo web. Tali vulnerabilità interessano la componente php-src e, qualora sfruttate, potrebbero permettere a un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi interessati.
-
· CSIRT Itálie (ACN) IT
PHP: sanate vulnerabilità critiche
Aggiornamenti di sicurezza sanano 2 nuove vulnerabilità con gravità "critica" in PHP, noto interprete del linguaggio di scripting per lo sviluppo web. Tali vulnerabilità interessano la componente php-src e, qualora sfruttate, potrebbero permettere a un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi interessati.
-
· BleepingComputer US
PHP ships emergency patches for critical PHP2Shell flaws
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]
-
· NCSC-NL NL
NCSC-2026-0443 [1.00] [H/H] Kwetsbaarheden verholpen in PHP
PHP heeft twee kritieke kwetsbaarheden verholpen. De kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt voor het uitvoeren van willekeurige code. Alle PHP-installaties die webverzoeken verwerken zijn getroffen. De kwetsbaarheid met kenmerk CVE-2026-109618 betreft geheugenbeschadiging bij de afhandeling van een Out-of-Memory-situatie. Hierdoor kunnen interne requestgegevens slechts gedeeltelijk worden geïnitialiseerd en tijdens de verwerking als geldige gegevens worden…
-
· CERT.at AT
Kritische Sicherheitslücken in PHP - Updates verfügbar
21. Oktober 2026 Beschreibung In PHP existieren zwei kritische Sicherheitslücken, deren Ausnutzung es nicht authentifizierten Angreifer:innen ermöglichen kann, aus der Ferne beliebigen Code auszuführen. Betroffen sind laut PHP-Projekt alle PHP-Installationen, die Web-Anfragen verarbeiten, darunter PHP-FPM, Apache mit mod_php, php-cgi, FrankenPHP und LiteSpeed. Bei CVE-2026-109618 kann die Behandlung von Out-of-Memory-Zuständen (OOM) PHP unterbrechen, während interne Anfragedaten nur teilweise…
-
· Palo Alto Unit 42 US
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 appeared first on Unit 42.
-
· SANS Internet Storm Ctr. US
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead of the patch becoming available. This diary will be continuously updated today. I am starting to write this diary with many details still unclear and with the patch not yet available. Which versions of PHP are vulnerable? The easy answer: All of them. At least…
-
· zachyceno · CISA Advisories US
Critical Vulnerabilities in PHP Require Immediate Patching
CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of…
-
· CERT-SE SE
Kritiska sårbarheter i PHP
PHP kommer vid klockan 16:00 svensk tid att publicera säkerhetsuppdateringar för två kritiska sårbarheter, CVE-2026-109618 och CVE-2026-109619. Sårbarheterna har fått en CVSS-klassning på 9.2 och kan utnyttjas för oautentiserad exekvering av skadlig kod. [1]
-
· CERT.hr HR
Kritične ranjivosti u PHP-u – objavljene zakrpe
Ažurirano: 21.10.2026. u 16:45 PHP Security Team najavio je izvanrednu sigurnosnu zakrpu zakazanu za 21. listopad 2026. u 16:00 sati (14:00 UTC). Pozivaju sve PHP korisnike na hitnu primjenu zakrpi. Prije službene objave procurile su informacije o dvjema kritičnim ranjivostima u jezgri PHP-a koje napadaču putem web zahtjeva omogućuju preuzimanje poslužitelja. Uspješno iskorištavanje ranjivosti napadaču omogućava izvršavanje proizvoljnog programskog koda (engl. remote code execution - RCE) bez…
-
· CERT.hr HR
UPOZORENJE: Kritične ranjivosti u PHP-u – čeka se nadogradnja
PHP Security Team najavio je izvanrednu sigurnosnu zakrpu zakazanu za 21. listopad 2026. u 16:00 sati (14:00 UTC). Pozivaju sve PHP korisnike na hitnu primjenu zakrpi. Prije službene objave procurile su informacije o dvjema kritičnim ranjivostima u jezgri PHP-a koje napadaču putem web zahtjeva omogućuju preuzimanje poslužitelja. Uspješno iskorištavanje ranjivosti napadaču omogućava izvršavanje proizvoljnog programskog koda (engl. remote code execution – RCE) bez autentifikacije. Radi se o…
-
· Tenable Research US
php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing…
-
· SK-CERT (NBÚ SR) SK
Národné centrum kybernetickej bezpečnosti SK-CERT varuje pred dvoma kritickými zraniteľnosťami v PHP, identifikovanými a
Národné centrum kybernetickej bezpečnosti SK-CERT varuje pred dvoma kritickými zraniteľnosťami v PHP, identifikovanými ako CVE-2026-109618 a CVE-2026-109619. Podľa aktuálne dostupných informácií môže úspešné zneužitie umožniť vzdialenému neautentifikovanému útočníkovi vykonať ľubovoľný kód na zasiahnutom systéme. Obe zraniteľnosti majú pridelené skóre CVSS v4.0 vo výške 9,2. Zraniteľnosti sú zneužiteľné vo všetkých verziách od PHP 5.0 až po... The post appeared first on SK-CERT.
-
· zachyceno · Fortinet PSIRT US
PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
CVSSv3 Score: 9.8 CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Revised on 2026-10-21 00:00:00
-
· Huntress US
Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.
-
· Qualys US
PHP Announces Critical Security Release for Two Vulnerabilities
On October 20, 2026, the PHP security team announced an upcoming security release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. The release is scheduled for October 21, 2026, at 14:00 UTC. PHP has indicated that the updates may be released earlier if vulnerability details become public or evidence of active exploitation emerges. Public reports have linked CVE-2026-109618 and CVE-2026-109619 to the upcoming PHP security release. However, PHP has not yet confirmed these…
-
· Aikido Security BE
What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Two critical PHP RCE flaws (CVE-2026-109618, CVE-2026-109619) are being patched. Every PHP version is affected. How to patch, a temporary mitigation, and how to check your hosts. Category: Vulnerabilities & Threats
-
· CERT-FR – avis FR
Multiples vulnérabilités dans PHP (21 octobre 2026)
De multiples vulnérabilités ont été découvertes dans PHP. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
-
· zachyceno · Elastic Security US
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
On October 20, 2026, details of two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online ahead of their coordinated disclosure and before any patch existed. The PHP security team responded with advance notice of an emergency security release, scheduled for October 21, 2026 at 14:00 UTC, and rated both flaws critical with a CVSS v4.0 score of 9.2. Researchers at watchTowr confirmed the vulnerabilities are real and said they reproduced CVE-2026…
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans PHP (21 octobre 2026)
De multiples vulnérabilités ont été découvertes dans PHP. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
-
· zachyceno · Sophos Threat Research GB
Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Categories: Threat Research Tags: advisory, vulnerability, php
-
· BleepingComputer US
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. [...]