Overview
- PHP Group
- PHP
- php-src
Description
Statistics
- 92 Posts
- 189 Interactions
Fediverse
Why it’s important to have well-funded programs for open source infrastructure: “In 2024, PHP underwent its first external security audit in years. The PHP Foundation secured funding from the @sovtechfund to organize this audit through OSTIF, and it was carried out by Quarkslab. While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618.”
As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed.
https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt on 2026-10-17 in MadPot telemetry, 4 days before public disclosure of CVE-2026-109618 & CVE-2026-109619. It originated from an IP associated w/a commercial anonymization network. While the vuln was under embargo, the targeting of a honeypot from an anonymized IP suggests the activity was conducted by a threat actor, tho it remains unclear how the actor acquired exploit information prior to disclosure.
PHP2Shell in OT-Anlagen: warum die Lücke Jahre bleibt
PHP2Shell (CVE-2026-109618/-109619) wird breit angegriffen. Max Gilg erklärt, welche OT-Geräte PHP nutzen und was Betreiber jetzt tun sollten.
#OTSecurity #ICS #KRITIS #NIS2 #Cybersicherheit
https://ot-cyber.de/blog/php2shell-in-ot-anlagen-warum-die-luecke-jahre-bleibt.html
Gotta love when your security devices at the edge of your network have two completely unpatched critical vulnerabilities.
ICYMI: CVE: CVE (Common Vulnerabilities and Exposures) is the public list giving each disclosed software flaw a unique ID such as CVE-2026-109618, run by MITRE since 1999. https://ppc.land/cve/ #CVE #CyberSecurity #VulnerabilityManagement #SoftwareFlaws #MITRE
Affected by PHP2Shell (CVE-2026-109618/CVE-2026-109619)? Freexian’s PHP LTS provides updates for PHP 5.6 and later on Debian 9+ and Ubuntu 18.04+. Explore our plans at https://www.freexian.com/lts/php/?utm_source=mastodon&utm_medium=social or get in touch to discuss your options.
Can we just stand still a second a acknowledge how well the #PHP2Shell vulnerability (CVE-2026-109618 & CVE-2026-109619) has been dealt with...
Good job #PHP Security Team !
PHP reported two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution.
All PHP-powered websites (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed) are at risk.
Affected: 8.5.x < 8.5.12; 8.4.x < 8.4.27; 8.3.x < 8.3.36; 8.2.x < 8.2.35; 8.1 and older.
⚠️ PoCs circulate. Patch now; if unable, isolate internet-facing apps until fixed!
See: https://cert.europa.eu/publications/security-advisories/2026-018/
#security #hacking #foss #opensource #web #programming #coding
PHP2Shell field report — the attacker-side view.
The first exploit-shaped request hit our Mirage honeypot fleet at 21:57 UTC on 20 Oct, ~16h before the patch embargo lifted. Over the next 48h: 9 source IPs, 7 countries, 2 distinct attack shapes.
Highlights:
One actor swept body size <1KB → 16KB+, 200+ unique payloads in 2 min — live calibration of the OOM trigger
The lead tool stamps ----p2shell<hex> into its multipart boundary: a zero-false-positive detection tell we haven’t seen documented elsewhere
A B8RAT/1.0 actor reaching for the deserialization path (CVE-2026-109619) while others hammer the OOM path (CVE-2026-109618)
Independent confirmation of the pre-disclosure exploitation Amazon & Cloudflare reported, from a second sensor network
Full writeup + IOCs:
https://offseq.com/en/research/php2shell-first-48-hours/
2/ Yesterday, Webuzo released an emergency patch to address #PHP2shell. Today, they released a regular release.
#Webuzo is Softaculous's popular hosting control panel for providers, resellers & site owners like CPANEL.
#cPanel #PHP2Shell #WPToolkit #CVE2026109618 #CVE2026109619 #CVE2026107663 #WebHosting #CyberSecurity
Everyone covered the PHP2Shell CVSS score and the emergency patch on 21 October. The line worth reading sits under that.
The same two bugs (CVE-2026-109618 and CVE-2026-109619) hit every server running PHP. What split the outcomes was not patching speed on the day. It was set weeks earlier: whether there was an asset inventory, whether the runtime was still supported, whether there was a WAF whose rules could be changed, whether the update path had been tested.
The teams running one command had those. The teams deciding whether to pull servers offline did not. A critical flaw with a same-day patch mostly tests preparation that already existed, or did not.
Id-SIRTII/CC just released (an hour ago) a security advisory regarding php2shell.
You can access the details here:
https://idsirtii.bssn.go.id/publications/advisories/security-advisory-kerentanan-pada-php2shell-cve-2026-109618-cve-2026-109619
#cybersecurity #infosec #indonesia #indonesiaNews #php2shell
Nothing here for PHP2Shell
On Wednesday PHP shipped emergency releases for two flaws in its core, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. A single request from somebody who never logged in can be enough to run code on the web server, and every PHP…
Update on #PHP2Shell Vulnerabilities
#CVE-2026-109618 & #CVE-2026-109619
Following our previous urgent advisory, the #PHP project officially released security updates on 21 October 2026 addressing the critical PHP2Shell vulnerabilities.
https://ksrc.karenit.net/blog/security-alert/update-on-php2shell-vulnerabilities
"Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed" 🤔 🕵️
https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html
#CVE2026109618 #CVE2026109619 #php #php2shell #exploit #cybersec #infosec
Service update: some PKP sites, including the Community Forum and our translation website, are experiencing intermittent issues. Our systems team is working to restore full service.
The downtime is related to critical PHP security updates (PHP2Shell, CVE-2026-109618 and CVE-2026-109619) we’re applying across our infrastructure.
Details:
https://pkp.sfu.ca/2026/10/22/pkp-service-update-october-2026/
⚠️ Mise à jour : alerte CERT-FR ⚠️
Le CERT-FR a connaissance de preuves de concept pour les vulnérabilités CVE-2026-109618 et CVE-2026-109619 pour des déploiements spécifique de PHP.
https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/
My new PHP2Shell Checker - Read - only PHP package checker for Debian 12/13. Checks PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619), APT updates, and package holds. #critical #cve #php2shell #php #checker #CVE-2026-109618 #CVE-2026-109619 https://github.com/toxy4ny/php2shell-checker https://gitlab.com/toxy4ny/php2shell-checker
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026. Under specific conditions, attackers can execute malicious code remotely. Only certain PHP versions are affected.
We've updated the affected components and reviewed our logs. No indication of exploitation so far. eclipso customers don't need to do anything.
Details: https://www.eclipso.de/blog/en/2026/10/22/php2shell-security-update-for-our-customers/
Hätte es ja gut gefunden, wenn mein Hoster mir irgendwas geschickt hätte. Oder es auf der Webseite Infos gegeben hätte. Nichts zu
(CVE-2026-109618) (CVE-2026-109619). Dabei ist das doch ein super Thema, um den Kunden klar zu machen: Wir haben das auf dem Schirm, wir arbeiten da dran, das ist unser Job und wir nehmen ihn ernst.
Oder verstehe ich hier was nicht?
Dafür werden mich jetzt ein paar Leute hassen, aber
codex exec --yolo 'Wir sind von 2 CVE betroffen: CVE-2026-109618 und CVE-2026-109619. Bitte mache das System wieder sicher.'
Funktioniert prima und dauert 5 Minuten.
I got an email from #DigitalOcean this morning -- "URGENT: Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) - Action Required" -- with advice on what to do, and saying their support team is there to help, with an actual replyable email address.
Which is good of them. But I thought I'd "purged my account data"?
Seems that did not "permanently remove a deactivated account’s data from DigitalOcean"...
https://docs.digitalocean.com/platform/accounts/deactivate/
PHP Fixes Land as Attacks Surge, Plus 2 Stories https://raymondtec.com/2026/10/php-security-update-attacks-surge-plus-2-stories/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief
PHP fixes are available as exploitation attempts surge. Also: Meta faces a $25 billion privacy judgment, and data-center companies promise fewer secrets.
#TechNews #CVE2026109618 #CVE2026109619 #DataCenters #Meta #PHP #privacy
For anyone curious about how an actual POC might work for the recent #PHP vulnerabilities, here is a full report along with POC written in Python. #php2shell https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online.
Researchers report potential RCE.
CVE-2026-109618 and CVE-2026-109619.
Fixes scheduled for October 21, 14:00 UTC.
Details - https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
Kudos to #Ubuntu for moving so quickly to deploy patched versions of relevant packages for the OS. Same for every other Linux distro that hustled before the announcement of this critical flaw in PHP, which is now being addressed by system admins everywhere.
php2shell (CVE-2026-109618 and CVE-2026-109619) – PHP critical vulnerability fixes available | Ubuntu
https://ubuntu.com/blog/php2shell-vulnerability-fixes-available
Vulnerability Analysis: CVE-2026-109618 amp; CVE-2026-109619 Critical Unauthenticated Remote Code Execution in PHP
read: https://denizhalil.com/2026/10/22/cve-2026-109618-cve-2026-109619-php-rce-analysis/
There are protections out there to help you buy time to patch all your systems for #php2shell
#Checkpoint #WAF and IPS both catch and prevent this attack
Workaround for 2 critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), disclosed on October 21, 2026
https://www.synoforum.com/threads/workaround-for-2-critical-vulnerabilities-in-the-php-engine-cve-2026-109618-and-cve-2026-109619-php2shell-disclosed-on-october-21-2026.16429/
PHP2Shell: due RCE non autenticate nel runtime PHP, CVE-2026-109618 e CVE-2026-109619, CVSS v4 9.2. Colpite quasi tutte le versioni (fino alla 5.4), mod_php il caso peggiore. Fix: 8.5.12, 8.4.27, 8.3.36, 8.2.35, backport 7.4/8.0/8.1. Cloudflare e watchTowr riportano tentativi di sfruttamento, nessuna compromissione confermata. Aggiornare il runtime e riavviare Apache/FPM: il CMS non basta. Mitigazione parziale: session.upload_progress.enabled=0. https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w #infosec #PHP
PHP2Shell : les correctifs de sécurité sont là, les attaques aussi ! https://www.it-connect.fr/php2shell-correctifs-urgence-cve-2026-109618-cve-2026-109619/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #PHP
Amazon Threat Intelligence and security firms detected exploit attempts targeting PHP core flaws CVE-2026-109618 and CVE-2026-109619.
The CVSS 9.2 rated vulnerabilities allow pre-authentication remote code execution across PHP 7.x and 8.x releases.
Following an early leak of details and proof-of-concept exploits, the PHP Foundation advanced the release of fixes by one day.
https://en.hacks.gr/sovara-kena-asfaleias-stin-php-epitrepoyn-apomakrysmeni-ektelesi-kodika/
QNAP PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect QTS, QuTS hero and apps. No patch yet, so take NAS devices offline.
#QNAP #PHP2Shell #QTS #CVE2026109618 #CVE2026109619 #NAS #RCE #CyberSecurity
Netcraft/NCSC reaching out to any email address they can find. I host my friend's wordpress blog and he got it to the info@ address as well as me getting it to webmaster@
Issue [#REDACTED]: Potentially vulnerable web application at hxxp://[REDACTED]
Hello,
On behalf of the National Cyber Security Centre (NCSC), we have identified software on your network that may be vulnerable and require remedial action.
The NCSC's mission is to make the UK the safest place to live and work online and as part of its Proactive Notification service, we are writing to alert you to a potential security issue that could be exploited by malicious actors.
This notification is based on our scanning of open-source information, such as publicly available software versions. The service was launched to responsibly report vulnerabilities to system owners to help them protect their services. If you are not the owner of this site, please ensure every effort is made to forward this email onto the webmaster.
The presence of this vulnerability may result in a criminal gaining unauthorised access to, leaking data from or otherwise disrupting your servers. Please follow the remediation steps listed below to address the vulnerability as soon as possible.
* Remote Code Execution in PHP (CVE-2026-109619)
hxxp://[REDACTED] [IP REDACTED]
Your PHP server has two critical remote code execution vulnerabilities (CVE-2026-109618 & CVE-2026-109619).
Successful exploitation could allow an attacker to compromise the server, deploy ransomware, steal data, or attack other machines on the network.
Update your PHP installation to at least one of the following versions immediately:
* 8.5.12
* 8.4.27
* 8.3.36
* 8.2.35
See https://www.php.net/archive/2026.php#2026-10-21-5 for more information about these vulnerabilities. This includes instructions on other measures to reduce your exposure if you can't update immediately.
Sign up for more notifications:
Every day, UK organisations are targeted by cyber criminals – whether for their data, their funds, or simply to cause disruption. Early Warning is a free service from the NCSC that notifies organisations of potential cyber threats before they cause harm. By signing up, you will receive timely alerts about malicious activity targeting your network – giving you the chance to take action early and reduce risk.
The more information you share with the NCSC Early Warning service about your IT estate, the more effectively monitoring can be tailored, ensuring you receive relevant, actionable notifications.
Paste this link in your browser to visit the Early Warning webpage to find out more and to sign up: https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning?referrer=ProactiveNotificationService
The NCSC website offers a wide range of guidance, tools and services to help organisations strengthen their cyber security. Whether you're a small business, a large enterprise, a charity, or part of the public sector, there is practical advice to help you protect your systems, data and people.
About this email:
The NCSC has engaged Netcraft to send notifications to organisations identified to be running software with known vulnerabilities, as part of the NCSC's mission to increase the UK's cyber resilience:
You are ultimately responsible for the security of your own networks and data, and for determining the steps that you take to protect yourself. This includes identifying and addressing vulnerabilities in your systems: this notification service does not cover all systems or vulnerabilities, so you must not rely on it as your sole source of alerts.
You are also best placed to appreciate the wider implications of our advice for the rest of your business, and it is for you to determine whether and how to implement our recommendations.
The NCSC processes your personal data in accordance with its privacy policy. For more information and your rights see https://www.ncsc.gov.uk/section/about-this-website/privacy-statement
More information about the detected issue is provided at https://incident.netcraft.com/reports/[REDACTED]
See https://incident.netcraft.com/about for more details including API support.
Kind regards,
Netcraft
Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: [REDACTED]
To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: support@netcraft.com.
@thephpf just shipped emergency security updates for two remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both are rated 9.2 on CVSS v4.0 and sit in the PHP runtime itself, so a site is exposed even when its own code is clean. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. #php #cybersecurity #wordpress https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
PHP2Shell (CVE-2026-109618, CVE-2026-109619) is unauthenticated remote code execution in PHP core, and the default configuration is exposed. Parsing happens before your application runs, so route-scoped WAF rules never see it.
Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Then hunt. Attacks were reported before the patch shipped, so run these four Graylog searches across your full retention period, not just from today.
https://graylog.org/post/detecting-php2shell-cves-with-graylog/
⚠️ CRITICAL: Widespread PHP Flaw May Cause Many Site Outages Today
Two critical PHP RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting PHP 5.4+ are actively being exploited in the wild. An estimated 70% of websites running WordPress, Drupal, Magento, and Joomla are at immediate risk of full server compromise. This is Log4Shell-level severity with exp…
🤖 AI generated summary
A critical security update addresses two PHP zero-day RCE vulnerabilities. Learn how to protect your servers from CVE-2026-109618 and CVE-2026-109619 today.
PHP2Shell (CVE-2026-109618/109619): two RCEs in PHP itself. Unauthenticated attackers can run code before any app code runs.
Patched: 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 8.1 and older: no fix from the PHP project, ask your distro.
Can't update today? Free, tentative CrowdSec WAF virtual patches:
CVE-2026-109618: https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2026-109618
CVE-2026-109619: https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2026-109619
A stopgap, not a fix.
Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), AI-discovered, now impact ~70% of global websites, leading to urgent patches and outages (Oct 22, 2026). Fortinet released urgent AI-found security updates for multiple products. Geopolitically, Israel intensified preparations for potential strikes on Iran, while Russia launched missile attacks on Kyiv hours after agreeing to talks.
#Cybersecurity #AnonNews_irc #News
Just so you know, #Citrix #NetScaler has a blog entry explaining how admins should deal with the #PHP bugs, because they're also affected
A cPanel PHP update fixes PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, while WP Toolkit 6.11.5 patches CVE-2026-107663.
#cPanel #PHP2Shell #WPToolkit #CVE2026109618 #CVE2026109619 #CVE2026107663 #WebHosting #CyberSecurity
En las últimas 24 horas, se corrigieron vulnerabilidades críticas en GitLab y Node.js que permiten ejecución remota de código, mientras una nueva herramienta de alta precisión detecta fallos PHP2Shell y OpenAI impulsa la identificación avanzada de fallos en PHP, demostrando la urgente necesidad de actualizar y fortalecer seguridad en entornos web. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:
🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 22/10/26 📆 |====
🔓 VULNERABILIDAD CRÍTICA EN GITLAB AFECTA 12 AÑOS DE VERSIONES
GitLab ha corregido una falla crítica (CVE-2026-110264) que permite la ejecución remota de código sin autenticación en versiones autogestionadas desde la 7.0. Esta vulnerabilidad con puntuación CVSS 10.0 representa un riesgo extremo para entornos empresariales y desarrolladores que utilizan esta plataforma. Es fundamental actualizar GitLab a la última versión para proteger sus sistemas contra posibles ataques remotos que podrían comprometer la integridad y disponibilidad de datos.
Proteja su infraestructura actualizando GitLab ahora y conozca más detalles aquí 👉 https://djar.co/WhTgv
🛡️ NUEVA HERRAMIENTA DE ALTA FIDELIDAD PARA DETECCIÓN DE PHP2SHELL
Se ha lanzado php2shell-scanner, una herramienta de código abierto que permite detectar con alta precisión las vulnerabilidades CVE-2026-109618 y CVE-2026-109619 en servidores que utilicen PHP. Estas fallas son explotadas para ejecutar código malicioso y comprometer sistemas. Esta solución de detección mejora la seguridad al facilitar auditorías rápidas y confiables para mitigar riesgos antes de que se produzcan incidentes.
Descargue y utilice php2shell-scanner para fortalecer la defensa de sus servidores visitando 👉 https://djar.co/VZN4pj
⚠️ RCE CRÍTICA EN NODE.JS POR FALLO EN DECODIFICADOR BROTLI
Node.js presentó una vulnerabilidad grave (CVE-2026-111497) que afecta las versiones 22, 24 y 26, permitiendo ejecución remota de código a través del decodificador Brotli. Vercel activó reglas en su Web Application Firewall para bloquear patrones de explotación conocidos, pero enfatizan que la única solución segura es actualizar a las versiones 22.23.4, 24.22.1 o 26.12.1. Este aviso es esencial para desarrolladores y administradores que utilicen Node.js en producción para evitar compromisos que afecten aplicaciones web.
Actualice Node.js y revise las recomendaciones de seguridad de Vercel aquí 👉 https://djar.co/zoOOY7
🤖 OPENAI IMPULSA EL DESCUBRIMIENTO DE FALLOS CRÍTICOS EN PHP
Gracias al apoyo de modelos avanzados de IA proporcionados por OpenAI, investigadores de la iniciativa "Patch the Planet" han identificado vulnerabilidades críticas en PHP, el lenguaje que impulsa cerca del 70% de las aplicaciones web en todo el mundo. Este hallazgo es vital para la comunidad de desarrolladores y responsables de seguridad, pues permite anticipar y corregir fallas que podrían ser aprovechadas por atacantes a gran escala. El uso de inteligencia artificial en seguridad sigue transformando la detección y mitigación de amenazas.
Conozca cómo OpenAI está revolucionando la seguridad en PHP visitando 👉 https://djar.co/OabJE
Bluesky
Overview
- PHP Group
- PHP
- php-src
Description
Statistics
- 85 Posts
- 167 Interactions
Fediverse
As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed.
https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt on 2026-10-17 in MadPot telemetry, 4 days before public disclosure of CVE-2026-109618 & CVE-2026-109619. It originated from an IP associated w/a commercial anonymization network. While the vuln was under embargo, the targeting of a honeypot from an anonymized IP suggests the activity was conducted by a threat actor, tho it remains unclear how the actor acquired exploit information prior to disclosure.
Affected by PHP2Shell (CVE-2026-109618/CVE-2026-109619)? Freexian’s PHP LTS provides updates for PHP 5.6 and later on Debian 9+ and Ubuntu 18.04+. Explore our plans at https://www.freexian.com/lts/php/?utm_source=mastodon&utm_medium=social or get in touch to discuss your options.
Can we just stand still a second a acknowledge how well the #PHP2Shell vulnerability (CVE-2026-109618 & CVE-2026-109619) has been dealt with...
Good job #PHP Security Team !
PHP reported two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution.
All PHP-powered websites (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed) are at risk.
Affected: 8.5.x < 8.5.12; 8.4.x < 8.4.27; 8.3.x < 8.3.36; 8.2.x < 8.2.35; 8.1 and older.
⚠️ PoCs circulate. Patch now; if unable, isolate internet-facing apps until fixed!
See: https://cert.europa.eu/publications/security-advisories/2026-018/
#security #hacking #foss #opensource #web #programming #coding
PHP2Shell field report — the attacker-side view.
The first exploit-shaped request hit our Mirage honeypot fleet at 21:57 UTC on 20 Oct, ~16h before the patch embargo lifted. Over the next 48h: 9 source IPs, 7 countries, 2 distinct attack shapes.
Highlights:
One actor swept body size <1KB → 16KB+, 200+ unique payloads in 2 min — live calibration of the OOM trigger
The lead tool stamps ----p2shell<hex> into its multipart boundary: a zero-false-positive detection tell we haven’t seen documented elsewhere
A B8RAT/1.0 actor reaching for the deserialization path (CVE-2026-109619) while others hammer the OOM path (CVE-2026-109618)
Independent confirmation of the pre-disclosure exploitation Amazon & Cloudflare reported, from a second sensor network
Full writeup + IOCs:
https://offseq.com/en/research/php2shell-first-48-hours/
2/ Yesterday, Webuzo released an emergency patch to address #PHP2shell. Today, they released a regular release.
#Webuzo is Softaculous's popular hosting control panel for providers, resellers & site owners like CPANEL.
#cPanel #PHP2Shell #WPToolkit #CVE2026109618 #CVE2026109619 #CVE2026107663 #WebHosting #CyberSecurity
Everyone covered the PHP2Shell CVSS score and the emergency patch on 21 October. The line worth reading sits under that.
The same two bugs (CVE-2026-109618 and CVE-2026-109619) hit every server running PHP. What split the outcomes was not patching speed on the day. It was set weeks earlier: whether there was an asset inventory, whether the runtime was still supported, whether there was a WAF whose rules could be changed, whether the update path had been tested.
The teams running one command had those. The teams deciding whether to pull servers offline did not. A critical flaw with a same-day patch mostly tests preparation that already existed, or did not.
Id-SIRTII/CC just released (an hour ago) a security advisory regarding php2shell.
You can access the details here:
https://idsirtii.bssn.go.id/publications/advisories/security-advisory-kerentanan-pada-php2shell-cve-2026-109618-cve-2026-109619
#cybersecurity #infosec #indonesia #indonesiaNews #php2shell
Nothing here for PHP2Shell
On Wednesday PHP shipped emergency releases for two flaws in its core, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. A single request from somebody who never logged in can be enough to run code on the web server, and every PHP…
Update on #PHP2Shell Vulnerabilities
#CVE-2026-109618 & #CVE-2026-109619
Following our previous urgent advisory, the #PHP project officially released security updates on 21 October 2026 addressing the critical PHP2Shell vulnerabilities.
https://ksrc.karenit.net/blog/security-alert/update-on-php2shell-vulnerabilities
"Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed" 🤔 🕵️
https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html
#CVE2026109618 #CVE2026109619 #php #php2shell #exploit #cybersec #infosec
Service update: some PKP sites, including the Community Forum and our translation website, are experiencing intermittent issues. Our systems team is working to restore full service.
The downtime is related to critical PHP security updates (PHP2Shell, CVE-2026-109618 and CVE-2026-109619) we’re applying across our infrastructure.
Details:
https://pkp.sfu.ca/2026/10/22/pkp-service-update-october-2026/
⚠️ Mise à jour : alerte CERT-FR ⚠️
Le CERT-FR a connaissance de preuves de concept pour les vulnérabilités CVE-2026-109618 et CVE-2026-109619 pour des déploiements spécifique de PHP.
https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/
My new PHP2Shell Checker - Read - only PHP package checker for Debian 12/13. Checks PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619), APT updates, and package holds. #critical #cve #php2shell #php #checker #CVE-2026-109618 #CVE-2026-109619 https://github.com/toxy4ny/php2shell-checker https://gitlab.com/toxy4ny/php2shell-checker
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026. Under specific conditions, attackers can execute malicious code remotely. Only certain PHP versions are affected.
We've updated the affected components and reviewed our logs. No indication of exploitation so far. eclipso customers don't need to do anything.
Details: https://www.eclipso.de/blog/en/2026/10/22/php2shell-security-update-for-our-customers/
Hätte es ja gut gefunden, wenn mein Hoster mir irgendwas geschickt hätte. Oder es auf der Webseite Infos gegeben hätte. Nichts zu
(CVE-2026-109618) (CVE-2026-109619). Dabei ist das doch ein super Thema, um den Kunden klar zu machen: Wir haben das auf dem Schirm, wir arbeiten da dran, das ist unser Job und wir nehmen ihn ernst.
Oder verstehe ich hier was nicht?
Dafür werden mich jetzt ein paar Leute hassen, aber
codex exec --yolo 'Wir sind von 2 CVE betroffen: CVE-2026-109618 und CVE-2026-109619. Bitte mache das System wieder sicher.'
Funktioniert prima und dauert 5 Minuten.
I got an email from #DigitalOcean this morning -- "URGENT: Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) - Action Required" -- with advice on what to do, and saying their support team is there to help, with an actual replyable email address.
Which is good of them. But I thought I'd "purged my account data"?
Seems that did not "permanently remove a deactivated account’s data from DigitalOcean"...
https://docs.digitalocean.com/platform/accounts/deactivate/
PHP Fixes Land as Attacks Surge, Plus 2 Stories https://raymondtec.com/2026/10/php-security-update-attacks-surge-plus-2-stories/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief
PHP fixes are available as exploitation attempts surge. Also: Meta faces a $25 billion privacy judgment, and data-center companies promise fewer secrets.
#TechNews #CVE2026109618 #CVE2026109619 #DataCenters #Meta #PHP #privacy
For anyone curious about how an actual POC might work for the recent #PHP vulnerabilities, here is a full report along with POC written in Python. #php2shell https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online.
Researchers report potential RCE.
CVE-2026-109618 and CVE-2026-109619.
Fixes scheduled for October 21, 14:00 UTC.
Details - https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
Kudos to #Ubuntu for moving so quickly to deploy patched versions of relevant packages for the OS. Same for every other Linux distro that hustled before the announcement of this critical flaw in PHP, which is now being addressed by system admins everywhere.
php2shell (CVE-2026-109618 and CVE-2026-109619) – PHP critical vulnerability fixes available | Ubuntu
https://ubuntu.com/blog/php2shell-vulnerability-fixes-available
Vulnerability Analysis: CVE-2026-109618 amp; CVE-2026-109619 Critical Unauthenticated Remote Code Execution in PHP
read: https://denizhalil.com/2026/10/22/cve-2026-109618-cve-2026-109619-php-rce-analysis/
There are protections out there to help you buy time to patch all your systems for #php2shell
#Checkpoint #WAF and IPS both catch and prevent this attack
Workaround for 2 critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), disclosed on October 21, 2026
https://www.synoforum.com/threads/workaround-for-2-critical-vulnerabilities-in-the-php-engine-cve-2026-109618-and-cve-2026-109619-php2shell-disclosed-on-october-21-2026.16429/
PHP2Shell: due RCE non autenticate nel runtime PHP, CVE-2026-109618 e CVE-2026-109619, CVSS v4 9.2. Colpite quasi tutte le versioni (fino alla 5.4), mod_php il caso peggiore. Fix: 8.5.12, 8.4.27, 8.3.36, 8.2.35, backport 7.4/8.0/8.1. Cloudflare e watchTowr riportano tentativi di sfruttamento, nessuna compromissione confermata. Aggiornare il runtime e riavviare Apache/FPM: il CMS non basta. Mitigazione parziale: session.upload_progress.enabled=0. https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w #infosec #PHP
PHP2Shell : les correctifs de sécurité sont là, les attaques aussi ! https://www.it-connect.fr/php2shell-correctifs-urgence-cve-2026-109618-cve-2026-109619/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #PHP
Amazon Threat Intelligence and security firms detected exploit attempts targeting PHP core flaws CVE-2026-109618 and CVE-2026-109619.
The CVSS 9.2 rated vulnerabilities allow pre-authentication remote code execution across PHP 7.x and 8.x releases.
Following an early leak of details and proof-of-concept exploits, the PHP Foundation advanced the release of fixes by one day.
https://en.hacks.gr/sovara-kena-asfaleias-stin-php-epitrepoyn-apomakrysmeni-ektelesi-kodika/
QNAP PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect QTS, QuTS hero and apps. No patch yet, so take NAS devices offline.
#QNAP #PHP2Shell #QTS #CVE2026109618 #CVE2026109619 #NAS #RCE #CyberSecurity
Netcraft/NCSC reaching out to any email address they can find. I host my friend's wordpress blog and he got it to the info@ address as well as me getting it to webmaster@
Issue [#REDACTED]: Potentially vulnerable web application at hxxp://[REDACTED]
Hello,
On behalf of the National Cyber Security Centre (NCSC), we have identified software on your network that may be vulnerable and require remedial action.
The NCSC's mission is to make the UK the safest place to live and work online and as part of its Proactive Notification service, we are writing to alert you to a potential security issue that could be exploited by malicious actors.
This notification is based on our scanning of open-source information, such as publicly available software versions. The service was launched to responsibly report vulnerabilities to system owners to help them protect their services. If you are not the owner of this site, please ensure every effort is made to forward this email onto the webmaster.
The presence of this vulnerability may result in a criminal gaining unauthorised access to, leaking data from or otherwise disrupting your servers. Please follow the remediation steps listed below to address the vulnerability as soon as possible.
* Remote Code Execution in PHP (CVE-2026-109619)
hxxp://[REDACTED] [IP REDACTED]
Your PHP server has two critical remote code execution vulnerabilities (CVE-2026-109618 & CVE-2026-109619).
Successful exploitation could allow an attacker to compromise the server, deploy ransomware, steal data, or attack other machines on the network.
Update your PHP installation to at least one of the following versions immediately:
* 8.5.12
* 8.4.27
* 8.3.36
* 8.2.35
See https://www.php.net/archive/2026.php#2026-10-21-5 for more information about these vulnerabilities. This includes instructions on other measures to reduce your exposure if you can't update immediately.
Sign up for more notifications:
Every day, UK organisations are targeted by cyber criminals – whether for their data, their funds, or simply to cause disruption. Early Warning is a free service from the NCSC that notifies organisations of potential cyber threats before they cause harm. By signing up, you will receive timely alerts about malicious activity targeting your network – giving you the chance to take action early and reduce risk.
The more information you share with the NCSC Early Warning service about your IT estate, the more effectively monitoring can be tailored, ensuring you receive relevant, actionable notifications.
Paste this link in your browser to visit the Early Warning webpage to find out more and to sign up: https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning?referrer=ProactiveNotificationService
The NCSC website offers a wide range of guidance, tools and services to help organisations strengthen their cyber security. Whether you're a small business, a large enterprise, a charity, or part of the public sector, there is practical advice to help you protect your systems, data and people.
About this email:
The NCSC has engaged Netcraft to send notifications to organisations identified to be running software with known vulnerabilities, as part of the NCSC's mission to increase the UK's cyber resilience:
You are ultimately responsible for the security of your own networks and data, and for determining the steps that you take to protect yourself. This includes identifying and addressing vulnerabilities in your systems: this notification service does not cover all systems or vulnerabilities, so you must not rely on it as your sole source of alerts.
You are also best placed to appreciate the wider implications of our advice for the rest of your business, and it is for you to determine whether and how to implement our recommendations.
The NCSC processes your personal data in accordance with its privacy policy. For more information and your rights see https://www.ncsc.gov.uk/section/about-this-website/privacy-statement
More information about the detected issue is provided at https://incident.netcraft.com/reports/[REDACTED]
See https://incident.netcraft.com/about for more details including API support.
Kind regards,
Netcraft
Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: [REDACTED]
To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: support@netcraft.com.
@thephpf just shipped emergency security updates for two remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both are rated 9.2 on CVSS v4.0 and sit in the PHP runtime itself, so a site is exposed even when its own code is clean. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. #php #cybersecurity #wordpress https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
PHP2Shell (CVE-2026-109618, CVE-2026-109619) is unauthenticated remote code execution in PHP core, and the default configuration is exposed. Parsing happens before your application runs, so route-scoped WAF rules never see it.
Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Then hunt. Attacks were reported before the patch shipped, so run these four Graylog searches across your full retention period, not just from today.
https://graylog.org/post/detecting-php2shell-cves-with-graylog/
⚠️ CRITICAL: Widespread PHP Flaw May Cause Many Site Outages Today
Two critical PHP RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting PHP 5.4+ are actively being exploited in the wild. An estimated 70% of websites running WordPress, Drupal, Magento, and Joomla are at immediate risk of full server compromise. This is Log4Shell-level severity with exp…
🤖 AI generated summary
A critical security update addresses two PHP zero-day RCE vulnerabilities. Learn how to protect your servers from CVE-2026-109618 and CVE-2026-109619 today.
PHP2Shell (CVE-2026-109618/109619): two RCEs in PHP itself. Unauthenticated attackers can run code before any app code runs.
Patched: 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 8.1 and older: no fix from the PHP project, ask your distro.
Can't update today? Free, tentative CrowdSec WAF virtual patches:
CVE-2026-109618: https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2026-109618
CVE-2026-109619: https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2026-109619
A stopgap, not a fix.
Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), AI-discovered, now impact ~70% of global websites, leading to urgent patches and outages (Oct 22, 2026). Fortinet released urgent AI-found security updates for multiple products. Geopolitically, Israel intensified preparations for potential strikes on Iran, while Russia launched missile attacks on Kyiv hours after agreeing to talks.
#Cybersecurity #AnonNews_irc #News
Just so you know, #Citrix #NetScaler has a blog entry explaining how admins should deal with the #PHP bugs, because they're also affected
A cPanel PHP update fixes PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, while WP Toolkit 6.11.5 patches CVE-2026-107663.
#cPanel #PHP2Shell #WPToolkit #CVE2026109618 #CVE2026109619 #CVE2026107663 #WebHosting #CyberSecurity
En las últimas 24 horas, se corrigieron vulnerabilidades críticas en GitLab y Node.js que permiten ejecución remota de código, mientras una nueva herramienta de alta precisión detecta fallos PHP2Shell y OpenAI impulsa la identificación avanzada de fallos en PHP, demostrando la urgente necesidad de actualizar y fortalecer seguridad en entornos web. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:
🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 22/10/26 📆 |====
🔓 VULNERABILIDAD CRÍTICA EN GITLAB AFECTA 12 AÑOS DE VERSIONES
GitLab ha corregido una falla crítica (CVE-2026-110264) que permite la ejecución remota de código sin autenticación en versiones autogestionadas desde la 7.0. Esta vulnerabilidad con puntuación CVSS 10.0 representa un riesgo extremo para entornos empresariales y desarrolladores que utilizan esta plataforma. Es fundamental actualizar GitLab a la última versión para proteger sus sistemas contra posibles ataques remotos que podrían comprometer la integridad y disponibilidad de datos.
Proteja su infraestructura actualizando GitLab ahora y conozca más detalles aquí 👉 https://djar.co/WhTgv
🛡️ NUEVA HERRAMIENTA DE ALTA FIDELIDAD PARA DETECCIÓN DE PHP2SHELL
Se ha lanzado php2shell-scanner, una herramienta de código abierto que permite detectar con alta precisión las vulnerabilidades CVE-2026-109618 y CVE-2026-109619 en servidores que utilicen PHP. Estas fallas son explotadas para ejecutar código malicioso y comprometer sistemas. Esta solución de detección mejora la seguridad al facilitar auditorías rápidas y confiables para mitigar riesgos antes de que se produzcan incidentes.
Descargue y utilice php2shell-scanner para fortalecer la defensa de sus servidores visitando 👉 https://djar.co/VZN4pj
⚠️ RCE CRÍTICA EN NODE.JS POR FALLO EN DECODIFICADOR BROTLI
Node.js presentó una vulnerabilidad grave (CVE-2026-111497) que afecta las versiones 22, 24 y 26, permitiendo ejecución remota de código a través del decodificador Brotli. Vercel activó reglas en su Web Application Firewall para bloquear patrones de explotación conocidos, pero enfatizan que la única solución segura es actualizar a las versiones 22.23.4, 24.22.1 o 26.12.1. Este aviso es esencial para desarrolladores y administradores que utilicen Node.js en producción para evitar compromisos que afecten aplicaciones web.
Actualice Node.js y revise las recomendaciones de seguridad de Vercel aquí 👉 https://djar.co/zoOOY7
🤖 OPENAI IMPULSA EL DESCUBRIMIENTO DE FALLOS CRÍTICOS EN PHP
Gracias al apoyo de modelos avanzados de IA proporcionados por OpenAI, investigadores de la iniciativa "Patch the Planet" han identificado vulnerabilidades críticas en PHP, el lenguaje que impulsa cerca del 70% de las aplicaciones web en todo el mundo. Este hallazgo es vital para la comunidad de desarrolladores y responsables de seguridad, pues permite anticipar y corregir fallas que podrían ser aprovechadas por atacantes a gran escala. El uso de inteligencia artificial en seguridad sigue transformando la detección y mitigación de amenazas.
Conozca cómo OpenAI está revolucionando la seguridad en PHP visitando 👉 https://djar.co/OabJE
Bluesky
Overview
- GitLab
- GitLab
Description
Statistics
- 16 Posts
- 18 Interactions
Fediverse
Faille critique de 10.0 sur Gitlab. Attention, la version mise à jour corrigeant est passée CETTE NUIT
https://www.linkedin.com/pulse/gitlab-vuln%C3%A9rabilit%C3%A9-critique-cve-2026-110264-ex%C3%A9cution-morico-4pbsf/
⚠️ Max-severity GitLab bug allows remote code execution over 12 years of releases
｢ The flaw, “under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression,” the vendor said in its release notes ｣
GitLab corrige la CVE-2026-110264, une faille critique qui touche toutes les versions depuis 2014 https://www.it-connect.fr/gitlab-cve-2026-110264-faille-critique-regex-onigmo/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #GitLab
GitLab-Sicherheitslücke CVE-2026-110264: Update empfohlen
Der anfällige Code stammt aus GitLab 7.0, das 2014 erschien. Daraus folgt nicht, dass die Schwachstelle über diesen Zeitraum ausgenutzt wurde:
https://www.all-about-security.de/gitlab-sicherheitsluecke-cve-2026-110264-update-empfohlen/
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw, tracked as CVE-2026-110264 and rated CVSS 10.0, that could let an unauthenticated attacker run code on a self-managed server, The Hacker News reports. The flaw is an integer overflow in the regular expression compiler and affects every version going back to 7.0, released in 2014. https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
Self-hosting promised sovereignty, yet here you are applying back-to-back emergency patches to a twelve-year-old regex engine because someone parsed an Org mode file.
https://www.rescana.com/post/gitlab-cve-2026-110264-unauthenticated-rce-october-2026
GitLab security fixes are really next level.
19.4.2: CVE-2026-97229 - Integer Overflow issue in CI/CD Regular Expression Compiler
Thanks joaxcar for reporting [...].
... **nine days** pass by ...
19.4.3: CVE-2026-110264 - Integer Overflow issue in Regular Expression Compiler
Thanks joaxcar for reporting [...].
Did they even bother to look further in fixing CVE-2026-97229? 🤔
And this is also wild for an RCE fix: "This patch includes database migrations that may impact your upgrade process."
En las últimas 24 horas, se corrigieron vulnerabilidades críticas en GitLab y Node.js que permiten ejecución remota de código, mientras una nueva herramienta de alta precisión detecta fallos PHP2Shell y OpenAI impulsa la identificación avanzada de fallos en PHP, demostrando la urgente necesidad de actualizar y fortalecer seguridad en entornos web. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:
🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 22/10/26 📆 |====
🔓 VULNERABILIDAD CRÍTICA EN GITLAB AFECTA 12 AÑOS DE VERSIONES
GitLab ha corregido una falla crítica (CVE-2026-110264) que permite la ejecución remota de código sin autenticación en versiones autogestionadas desde la 7.0. Esta vulnerabilidad con puntuación CVSS 10.0 representa un riesgo extremo para entornos empresariales y desarrolladores que utilizan esta plataforma. Es fundamental actualizar GitLab a la última versión para proteger sus sistemas contra posibles ataques remotos que podrían comprometer la integridad y disponibilidad de datos.
Proteja su infraestructura actualizando GitLab ahora y conozca más detalles aquí 👉 https://djar.co/WhTgv
🛡️ NUEVA HERRAMIENTA DE ALTA FIDELIDAD PARA DETECCIÓN DE PHP2SHELL
Se ha lanzado php2shell-scanner, una herramienta de código abierto que permite detectar con alta precisión las vulnerabilidades CVE-2026-109618 y CVE-2026-109619 en servidores que utilicen PHP. Estas fallas son explotadas para ejecutar código malicioso y comprometer sistemas. Esta solución de detección mejora la seguridad al facilitar auditorías rápidas y confiables para mitigar riesgos antes de que se produzcan incidentes.
Descargue y utilice php2shell-scanner para fortalecer la defensa de sus servidores visitando 👉 https://djar.co/VZN4pj
⚠️ RCE CRÍTICA EN NODE.JS POR FALLO EN DECODIFICADOR BROTLI
Node.js presentó una vulnerabilidad grave (CVE-2026-111497) que afecta las versiones 22, 24 y 26, permitiendo ejecución remota de código a través del decodificador Brotli. Vercel activó reglas en su Web Application Firewall para bloquear patrones de explotación conocidos, pero enfatizan que la única solución segura es actualizar a las versiones 22.23.4, 24.22.1 o 26.12.1. Este aviso es esencial para desarrolladores y administradores que utilicen Node.js en producción para evitar compromisos que afecten aplicaciones web.
Actualice Node.js y revise las recomendaciones de seguridad de Vercel aquí 👉 https://djar.co/zoOOY7
🤖 OPENAI IMPULSA EL DESCUBRIMIENTO DE FALLOS CRÍTICOS EN PHP
Gracias al apoyo de modelos avanzados de IA proporcionados por OpenAI, investigadores de la iniciativa "Patch the Planet" han identificado vulnerabilidades críticas en PHP, el lenguaje que impulsa cerca del 70% de las aplicaciones web en todo el mundo. Este hallazgo es vital para la comunidad de desarrolladores y responsables de seguridad, pues permite anticipar y corregir fallas que podrían ser aprovechadas por atacantes a gran escala. El uso de inteligencia artificial en seguridad sigue transformando la detección y mitigación de amenazas.
Conozca cómo OpenAI está revolucionando la seguridad en PHP visitando 👉 https://djar.co/OabJE
Bluesky
Overview
Description
Statistics
- 12 Posts
- 31 Interactions
Fediverse
good luck, i guess, idk, i'm gonna go make a sandwich https://kb.isc.org/docs/cve-2026-94300
DNS. DNS. DNS.
https://www.cve.org/CVERecord?id=CVE-2026-94300
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "
named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Bluesky
Overview
- Arista Networks
- VeloCloud Orchestrator
Description
Statistics
- 8 Posts
- 10 Interactions
Fediverse
Cybersecurity Awareness Month isn't over yet: Arista VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625 (CVSSv3.1: 9.9 critical , CVSS4: 9.4)
This issue was detected by Arista and is known to be actively exploited.
https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
🚨 Critical Arista VeloCloud Orchestrator SQL injection flaw actively exploited
Arista has disclosed CVE-2026-114625, a critical vulnerability affecting on-premises VeloCloud Orchestrator deployments.
⠀
The SQL injection flaw allows any authenticated user, including someone with the lowest built-in Enterprise Read Only role, to gain operator privileges and impersonate a local “superuser operator.”
Arista says the vulnerability is being actively exploited.
⠀
CVSS: 9.9
Affected:
• VCO 5.2.x before 5.2.3.18
• VCO 6.1.x before 6.1.3.10
• VCO 6.4.x before 6.4.2.12
Fixed:
• VCO 5.2.3.18
• VCO 6.1.3.10
• VCO 6.4.2.12
⠀
Hosted and Dedicated instances have already been patched. VeloCloud Edge and Gateway products are not directly affected.
Administrators should update immediately and investigate affected systems for signs of compromise.
Source: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
Arista says VeloCloud Orchestrator vulnerability CVE-2026-114625, a CVSS 9.9 SQL injection, is exploited in the wild. Upgrade on-prem VCO now.
#Arista #VeloCloud #CVE2026114625 #SQLInjection #SDWAN #ExploitedInTheWild #ZeroDay #CyberSecurity
Arista issued an advisory on October 22, 2026, regarding a vulnerability in VeloCloud Orchestrator tracked as CVE-2026-114625 with a CVSS score of 9.9.
The flaw allows anyone logging in with an Enterprise Read Only account to gain operator privileges, and is being used in real-world attacks.
Fixes are available in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.
‼️ Critical VeloCloud SQL injection flaw exploited in the wild.
Tracked as CVE-2026-114625 (CVSS 9.9), the flaw lets even read-only users escalate to full operator privileges.
Arista confirms active attacks.
What admins need to know ↓ https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html
Bluesky
Overview
Description
Statistics
- 5 Posts
- 18 Interactions
Fediverse
Bluesky
Overview
- Brotli
- github.com/google/brotli
Description
Statistics
- 6 Posts
- 2 Interactions
Fediverse
«Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high)»
Source: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
At this point, shouldn't we just delete it all and start again with (Safe) Haskell?
Just saying … since 2018 https://uniprocess.org/ («you reap what you sow»).
me: welp i dont do anything with php, so i guess i dont have to worry much
node: hi get cve'd with a RCE
me: fffuuucckkkkk
Is your Node.js application vulnerable to CVE-2026-111497?
A newly disclosed High-severity vulnerability in the Node.js Brotli decoder could allow remote code execution when attacker-controlled compressed data reaches the affected component.
Request a SecPoint Penetrator demonstration:
https://www.secpoint.com/contact-me.php
Become a SecPoint partner:
https://www.secpoint.com/partner-signup.php
#NodeJS #CVE2026111497 #SecPointPenetrator #VulnerabilityScanning #Cybersecurity
En las últimas 24 horas, se corrigieron vulnerabilidades críticas en GitLab y Node.js que permiten ejecución remota de código, mientras una nueva herramienta de alta precisión detecta fallos PHP2Shell y OpenAI impulsa la identificación avanzada de fallos en PHP, demostrando la urgente necesidad de actualizar y fortalecer seguridad en entornos web. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:
🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 22/10/26 📆 |====
🔓 VULNERABILIDAD CRÍTICA EN GITLAB AFECTA 12 AÑOS DE VERSIONES
GitLab ha corregido una falla crítica (CVE-2026-110264) que permite la ejecución remota de código sin autenticación en versiones autogestionadas desde la 7.0. Esta vulnerabilidad con puntuación CVSS 10.0 representa un riesgo extremo para entornos empresariales y desarrolladores que utilizan esta plataforma. Es fundamental actualizar GitLab a la última versión para proteger sus sistemas contra posibles ataques remotos que podrían comprometer la integridad y disponibilidad de datos.
Proteja su infraestructura actualizando GitLab ahora y conozca más detalles aquí 👉 https://djar.co/WhTgv
🛡️ NUEVA HERRAMIENTA DE ALTA FIDELIDAD PARA DETECCIÓN DE PHP2SHELL
Se ha lanzado php2shell-scanner, una herramienta de código abierto que permite detectar con alta precisión las vulnerabilidades CVE-2026-109618 y CVE-2026-109619 en servidores que utilicen PHP. Estas fallas son explotadas para ejecutar código malicioso y comprometer sistemas. Esta solución de detección mejora la seguridad al facilitar auditorías rápidas y confiables para mitigar riesgos antes de que se produzcan incidentes.
Descargue y utilice php2shell-scanner para fortalecer la defensa de sus servidores visitando 👉 https://djar.co/VZN4pj
⚠️ RCE CRÍTICA EN NODE.JS POR FALLO EN DECODIFICADOR BROTLI
Node.js presentó una vulnerabilidad grave (CVE-2026-111497) que afecta las versiones 22, 24 y 26, permitiendo ejecución remota de código a través del decodificador Brotli. Vercel activó reglas en su Web Application Firewall para bloquear patrones de explotación conocidos, pero enfatizan que la única solución segura es actualizar a las versiones 22.23.4, 24.22.1 o 26.12.1. Este aviso es esencial para desarrolladores y administradores que utilicen Node.js en producción para evitar compromisos que afecten aplicaciones web.
Actualice Node.js y revise las recomendaciones de seguridad de Vercel aquí 👉 https://djar.co/zoOOY7
🤖 OPENAI IMPULSA EL DESCUBRIMIENTO DE FALLOS CRÍTICOS EN PHP
Gracias al apoyo de modelos avanzados de IA proporcionados por OpenAI, investigadores de la iniciativa "Patch the Planet" han identificado vulnerabilidades críticas en PHP, el lenguaje que impulsa cerca del 70% de las aplicaciones web en todo el mundo. Este hallazgo es vital para la comunidad de desarrolladores y responsables de seguridad, pues permite anticipar y corregir fallas que podrían ser aprovechadas por atacantes a gran escala. El uso de inteligencia artificial en seguridad sigue transformando la detección y mitigación de amenazas.
Conozca cómo OpenAI está revolucionando la seguridad en PHP visitando 👉 https://djar.co/OabJE
Bluesky
Overview
- Oracle Corporation
- Oracle Java SE
Description
Statistics
- 7 Posts
- 4 Interactions
Fediverse
🚨 Oracle patches critical unauthenticated Java vulnerability; CVE-2026-91403
A critical vulnerability in the Java Secure Socket Extension component affects Oracle Java SE and multiple GraalVM releases.
The flaw carries a CVSS score of 9.1 and can be exploited remotely without credentials or user interaction.
⠀
Successful exploitation could allow attackers to access, create, delete or modify critical data available to the affected Java or GraalVM deployment.
Affected products include:
• Oracle Java SE 8, 11, 17, 21, 25 and 27 releases listed by Oracle
• Oracle GraalVM for JDK 17.0.21 and 21.0.13
• Oracle GraalVM Enterprise Edition 21.3.20
⠀
Oracle released a security patch on October 21 and recommends applying the available updates.
Source:
https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
Oracle Java security alert CVE-2026-91403 (CVSS 9.1) distrusts compromised eMudhra intermediate certificates in Java SE and GraalVM. Update now.
#Oracle #Java #eMudhra #CVE202691403 #GraalVM #TLS #PKI #CyberSecurity
A critical Oracle Java SE vulnerability, CVE-2026-91403, threatens systems worldwide. Discover affected GraalVM versions and immediately update your software.
#Oracle #JavaSE #CyberSecurity #CVE202691403 #GraalVM
https://dailytechnow.com/oracle-java-se-vulnerability-cve-2026-91403/
Bluesky
Overview
- Go standard library
- crypto/x509
- crypto/x509
Description
Statistics
- 6 Posts
- 12 Interactions
Fediverse
Solid work day here at #cloudron. Updates to over 180 packages. First time we had to rebuild all our packages! Cloudron 10.1.6 is close on the heels.
Covers fixes to:
* #php2shell
* eMudhra cert compromise
* Go - https://nvd.nist.gov/vuln/detail/cve-2026-111943
* GitLab - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
Overview
Description
Statistics
- 3 Posts
- 28 Interactions