📣 Announcing the immediate availability of:

- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12

‼️ These address the following critical security issues:

- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
:windows8: Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

Zwei kritische PHP-Lücken (CVE-2026-109618/109619, CVSS 9,2) ermöglichen unter bestimmten Bedingungen die Ausführung von Schadcode auf Webservern.

Dringend patchen! Für PHP 8.4 ist Version 8.4.27 erforderlich. Unter Debian 13 sind die Updates bereits verfügbar:

apt update && apt upgrade

Anschließend PHP-FPM neu starten:

systemctl restart php8.4-fpm

Auch andere Distributionen sollten jetzt aktualisiert werden!

https://www.php.net/archive/2026.php

#PHP #ITSecurity

Massive thanks to Ondřej Surý for spinning out vast php builds in a big hurry.

@deb seems to be quiet here, but the hours are definitely getting put in elsewhere. [ @ondrej !]

#php
#sury
#cve2026109618
#cve2026109619

Graphic is a paraphrase of XKCD, from https://codeberg.org/oerdnj/deb.sury.org/issues/145

PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.

If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.

Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

Jesus Christ patch your shit now

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-109618/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.

Here is what you need to know:

* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 

* The root is a decades-old design choice in PHP's error handling (described more in our post)

* There was evidence of in-the-wild exploitation pre-disclosure. 

The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application

We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.

What to do right now:

The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.

Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012. 

The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours. 

Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.

Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.

Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com

Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618

Kritische PHP-Sicherheitslücken (CVE-2026-109618/-109619)

Unser gesamtes Team arbeitet an der Betroffenheitsanalyse der bekannt gewordenen Schwachstellen und bereitet das Einspielen des PHP-Patches vor, der heute um 16 Uhr erscheinen soll.

Aufgrund der Wartungsarbeiten kann es zu Unterbrechungen kommen. Wir bitten um Ihr Verständnis.

Betreiben Sie eigene Systeme mit PHP? Führen Sie heute dringend das Update auf die neue Version durch.

Wir halten Sie auf dem Laufenden.

Notable PHP Enjoyer Palo Alto has posted their advisory on #PHP2Shell:

https://security.paloaltonetworks.com/CVE-2026-109618

ALL versions of Panorama and PAN-OS are affected. There's a fix coming, but right now I recommend shutting down anything exposed publicly, like VPN portals.

Must-read blog post from the PHP foundation:

> [ In 2024 ] a PHP core developer contracted by the PHP Foundation found the first signs of the [out-of-memory] OOM problem behind CVE-2026-109618.

> the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#php2shell

Fixes for PHP CVE-2026-109618 and CVE-2026-109619 have either landed or are on their way.

Fixed versions:

- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35

Check https://build.alpinelinux.org for the current status of each builder, and https://pkgs.alpinelinux.org to see what is present in each repository.

https://pkgs.alpinelinux.org/packages?name=php%253F%253F&branch=v3.24 for example shows the current version of PHP on the v3.24 branch.

Critical PHP security vulnerabilities (CVE-2026-109618/-109619)

Our entire team is working on assessing the impact of the disclosed vulnerabilities and preparing to deploy the PHP patch, which is due to be released today at 4 pm.

Due to maintenance work, there may be some service interruptions. We apologise for any inconvenience caused.

Do you run your own systems using PHP? Please carry out the update to the new version as a matter of urgency today.

We will keep you informed.

PHP2Shell is now under active exploitation

https://www.linkedin.com/posts/yesterday-information-leaked-about-two-share-7518682504153796609-1os5/

https://x.com/PrevidianCyber/status/2112936591719068048

https://x.com/OliverSild/status/2112823822411866215

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

#php2shell landed:

https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Wheeeeeeeee!

The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

⚠️PHP2Shell: Kritische PHP-Lücken CVE-2026-109618/109619⚠️

Zwei kritische PHP-Sicherheitslücken („PHP2Shell“) wurden am 20. Oktober vor Ablauf der Sperrfrist öffentlich. Das PHP-Team hat die Patch-Veröffentlichung für (16:00MEZ) vorgesehen.

Betroffen ist praktisch jede PHP-Website: #WordPress, #WooCommerce, #Drupal, #Joomla, #Magento. Das geleakte Exploit-Tool nennt PHP ab 5.4.0; offizielle Fixes unterstüzen nur PHP 8.2 bis 8.5 .

#php #php2shell #kritischelücke #sicherheit

Palo finally published an advisory:

https://security.paloaltonetworks.com/CVE-2026-109618

No patch but some customers can get detections. Thanks, Palo. Fucking worthless fucks.

Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.

After publication of the vulnerability and patches, Advanced Threat Prevention (ATP) will release standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625), on Oct 21st.

The security risk posed by this issue on PAN-OS is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.

PHP2Shell: mitigating with CRS and AppArmor before the patch

https://blog.frehi.be/2026/10/21/php2shell-mitigating-with-crs-and-apparmor-before-the-patch/

Hey! Five alarm #infosec fire! Government websites across Europe have been taken offline following the discovery of two critical security vulnerabilities in PHP, a programming language that underpins a massive portion of the internet.

On October 21, 2026, PHP developers announced emergency patches fixing two flaws (tracked as CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, giving hackers the ability to take control of servers.

PHP is pervasive. It serves as the underlying engine for major content management systems like #WordPress, #Drupal and #Joomla.

Cybersecurity teams globally are being urged to immediately isolate any vulnerable, internet-facing PHP servers until official emergency updates (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) can be manually deployed.

Cloudflare has implemented temporary firewall mitigation rules, but experts stress this is only a stopgap measure.

Go patch your #php. Now.

https://www.globalbankingandfinance.com/cyber-agency-warns-websites-go-dark-php-prepares-critical/

Okay ( and thanks @gizmomathboy ) nice, nice, now we're talking.

Local-only exploit tester.

So now I just have to decide whether to trust… running PHP code on my server… written by an unknown third party… whose github is overflowing with AI slop.

https://github.com/slabbdev/php2shell-cve-2026-109618-109619

…oh. Hm. Maybe I didn't think through the implications of trawling the internet looking for vulnerability exploits to run on my server

Matrix über die PHP-Releases:

https://ma.ttias.be/php-cve-2026-109618-patch/#package-status

#nextcloud #php

📰 The PHP development team has released emergency security updates for two critical flaws that can allow unauthenticated remote code execution on affected web servers....

📡 Read full story here 👇

https://ctcnews.ca/2026/10/21/php-vulnerability-critical-php-flaws-patched-cve-2026-109618/

For those running pfSense+ (and possibly pfSense CE), it seems like PHP packages are starting to roll out:

https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619/15

#pfSense

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt on 2026-10-17 in MadPot telemetry, 4 days before public disclosure of CVE-2026-109618 & CVE-2026-109619. It originated from an IP associated w/a commercial anonymization network. While the vuln was under embargo, the targeting of a honeypot from an anonymized IP suggests the activity was conducted by a threat actor, tho it remains unclear how the actor acquired exploit information prior to disclosure.

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

Two critical vulnerabilities in PHP, nicknamed php2shell, were disclosed by PHP today: CVE-2026-109618 and CVE-2026-109619.

AlmaLinux 8, 9, and 10 all ship affected PHP versions, and we will release patched packages for testing today.

🔗 https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/

PHP2Shell in OT-Anlagen: warum die Lücke Jahre bleibt

PHP2Shell (CVE-2026-109618/-109619) wird breit angegriffen. Max Gilg erklärt, welche OT-Geräte PHP nutzen und was Betreiber jetzt tun sollten.

#OTSecurity #ICS #KRITIS #NIS2 #Cybersicherheit
https://ot-cyber.de/blog/php2shell-in-ot-anlagen-warum-die-luecke-jahre-bleibt.html

RCE via OOM corruption, CVE-2026-109618 ([GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

Wer nicht updaten kann:
RCE via OOM corruption (CVE-2026-109618):
- Set memory_limit=-1, preferably in a way applications can't override, such as php_admin_value in the FPM
- Set a low post_max_size. For applications that don't require file uploads, set post_max_size = 8M.
- Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable allocation failure.

"Plusieurs vulnérabilités critiques découvertes dans #PHP : installez immédiatement les mises à jour de sécurité"

"Deux vulnérabilités critiques dans PHP pourraient permettre à un attaquant d'exécuter du code malveillant sur les serveurs concernés sans avoir à s’authentifier. Des mises à jour de sécurité sont désormais disponibles. L'Office fédéral de la cybersécurité (OFCS) recommande de mettre à jour immédiatement les systèmes concernés. Outre les serveurs web, vérifiez également les applications et les appareils qui utilisent PHP comme composant intégré."
👇
https://www.bacs.admin.ch/fr/warnung-php-fr

🔍
👇
https://security-hub.ncsc.admin.ch/#/posts/13083

🇪🇺
👇
https://db.gcve.eu/vuln/CVE-2026-109618

#CyberVeille #PHP2shell

real elephants set memory_limit to -1

#php #php2shell #Cve2026109618

#php2shell - Für #Serveradmin , die noch ältere Versionen, zumindest eine zeitlang, benötigen, bietet @php Backports für die folgenden #PHP-Versionen an. So kann man eine gepachte Version selbst bauen.

#PHP74 https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619

#PHP80 https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619

#PHP81 https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619

#cve-2026-109618 #php2shell

Some info on the thing that’s going to break all our internet facing stuff…

https://www.melurna.com/blog/php2shell-php-vulnerability-cve-2026-109618/

#php #cve2026109618

CVE: CVE (Common Vulnerabilities and Exposures) is the public list giving each disclosed software flaw a unique ID such as CVE-2026-109618, run by MITRE since 1999. https://ppc.land/cve/ #CVE #CyberSecurity #VulnerabilityManagement #InfoSec #SoftwareSecurity

Two serious vulnerabilities have been identified in PHP, which is used by around 70% of websites worldwide.

The PHP Foundation released fixes on October 21, 2026.

VulnCheck, Cloudflare and Patchstack reported attempts to investigate the flaws from malicious IP addresses.

One attempt tied to CVE-2026-109618 failed because the targeted file was not present.

Cloudflare also reported attempts to bypass defenses by changing…

https://en.hacks.gr/dyo-kena-asfaleias-stin-php-kai-idi-katagrafontai-apopeires-eisvolis/

#PHP #CVE2026109618 #PHPFoundation #Patchstack

📰 Fedora Haberi

PHP paketlerinde CVE-2026-109618/109619 güvenlik açıkları giderildi

PHP geliştiricileri yamaları yayınladı ancak 21 Ekim 2026 itibarıyla Fedora depolarında henüz mevcut değil. Açıklar kimlik doğrulama olmadan Uzak Kod Çalıştırma (RCE) riski taşıyor.

🔗 https://birolkurnaz.com/l/TVCUyO
📊 1 kaynak: Fedora-Discussion

#fedora #linux #haber

#Webuzo, Softaculous's hosting control panel for providers, resellers & site owners like CPANEL, has released an emergency release to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619. #PHP #PHP2shell #Selfhosting #CVE

PHP InfoSec

Wise system administrators who have caught wind of this bug have taken measures already

It hasn't been patched yet but you can mitigate exposure of your systems.
Better yet, do what is written on tweakers.net

Quotes:

Make your store read-only or take it offline

If you can afford to take a PHP server offline for a day, do so. PHP core developer Gina Peter Banyard calls that the most sensible option. Several Dutch sites went offline as a precaution on October 21: tech site Tweakers, the House of Representatives (Tweede Kamer), the National Cyber Security Centre (NCSC) and security news site Security.NL.

Stop PHP-FPM and have your web server show a static maintenance page. The maintenance modes built into Magento and WordPress do not help: PHP still parses each request before the application checks for the maintenance flag.

If you cannot go offline, make the store read-only. Have your web server reject every request method other than GET and HEAD, for example in nginx:

if ($request_method !~ ^(GET|HEAD)$) {
return 503;
}

Quote:

Websites overnemen

De twee kritieke kwetsbaarheden in PHP (CVE-2026-109618 en CVE-2026-109619) hebben een score van 9,2 op de CVSS v4.0-schaal, die tot 10 gaat. Dat hoge cijfer is gebaseerd op de ernst van een kwetsbaarheid en op hoe makkelijk aanvallers die kunnen misbruiken. De kwetsbaarheden zouden al sinds versie 5.4.0 in PHP zitten, die in maart 2012 uitkwam. Aanvallers kunnen door de kwetsbaarheden eigen webpagina's publiceren. Daardoor kunnen zij mogelijk malware verspreiden. Daarnaast zou de zogeheten PHP2Shell-exploit het mogelijk maken om eigen code uit te voeren op kwetsbare servers.

Volgens verschillende beveiligingsadviezen kan het helpen om session.upload_progress.enabled uit te schakelen. Een bijbehorende tijdelijke oplossing zou zijn om session.use_strict_mode in te schakelen. Beveiligingsexpert Kevin Beaumont meldt dat de Linux-kernelbeveiligingsmodule AppArmor of SELinux ook bescherming biedt tegen misbruik van deze grote PHP-kwetsbaarheden.

I understand the NL language
Translate this if you don't

Jump to the sources read and work

Sources:

https://jackalsyn.com/posts/php-up-2026.html

https://sansec.io/research/php2shell

https://tweakers.net/

#PHP #bug #serious #infoSEC #programming #upgrade

Update: Patched PHP packages are now available for testing! After the community has helped verify them, we will release them to the production repositories.

Learn more and help with testing: https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/

Amazon just pushed out 2023.12.20261021 but it does *not* fix CVE-2026-109618 and CVE-2026-109619 so that's cool, cool. No hurry, guys. https://explore.alas.aws.amazon.com

Since AWS is feeling lackadaisical about all this... Is it believed that putting this in my php-fpm pools is sufficient?

; CVE-2026-109618
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 16M

; CVE-2026-109619
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[max_file_uploads] = 20
php_admin_value[fatal_error_backtraces] = 0

RE: https://infosec.exchange/@Spartan_1986/117480764972910966

So, that build date got me thinking. What if Canonical did implement the fix, but they are not reporting all the build digits? I know. That's stupid. But fortunately I can check on that. I've a Pro account and the server is, of course, registered with the Pro binary installed. You can force any CVE update with a the command "sudo pro fix CVE-YYYY-XXXX". So I ran the command for the two CVEs involved with this vuln. Here's what I got:

*******************************
$ sudo pro fix CVE-2026-109618
CVE-2026-109618: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109618

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109618 is resolved.
$ sudo pro fix CVE-2026-109619
CVE-2026-109619: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109619

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109619 is resolved.
*******************************

Damn it Canonical! Digits f-ing matter!!! Why do you have to be so stupid. I frankly don't even know if I can trust this. It should report the correct version with 'php -v' you numbskulls. This is why I got out of system administration in the first place.

TR-102 Critical Remote Code Execution Vulnerabilities in PHP - CVE-2026-109618 and CVE-2026-109619

🔗 https://www.circl.lu/pub/tr-102/

#cve #vulnerabilitymanagement #cybersecurity #php

PHP:sta on löytynyt kaksi kriittistä haavoittuvuutta (CVE-2026-109618 ja CVE-2026-109619), joista Kyberturvallisuuskeskus on julkaissut tiedotteen. Korjattu PHP-versio julkaistaan tänään klo 17, ja asennamme sen ylläpitämillemme palvelimille heti julkaisun jälkeen.

Osalla palvelimista teemme päivityksen vaatimia valmistelutöitä jo ennen klo 17. Huoltoikkunan aikana sivustoilla voi esiintyä lyhyitä katkoja tai hitautta. Useimmilla sivustoilla päivitys ei näy käyttäjille lainkaan.

https://status.dude.fi/en/maintenance/1097234

#Tietoturva #PHP #Vulnerabilities #DigitoimistoDude #CVE

Can we just stand still a second a acknowledge how well the #PHP2Shell vulnerability (CVE-2026-109618 & CVE-2026-109619) has been dealt with...

Good job #PHP Security Team !

Claims of the PHP vulns being EITW:

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

php2shell Schwachstelle in PHP gefährdet viele Projekte (WordPress, Drupal, ...). Bald soll es PHP-Updates geben. Hoffen wir, dass die Hoster die schnell installieren.

https://borncity.com/blog/2026/10/21/php2shell-php-schwachstellen-cve-2026-109618-und-cve-2026-109619/

We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

#php2shell #php #CVE #eitw

PHP-Sicherheitslücke CVE-2026-109618 und CVE-2026-109619: @lmz empfiehlt Abschaltung von Nextclouds. Verständlich, aber für digitale Schule eine Katastrophe.
@univention, @Karlitschek und @lmz: Bis wann können wir hoffen, dass Patch da ist und wir NextCloud wieder online nehmen können? Wäre echt wichtig, dass das schnell klappt!
#eduBW
cc: @KM_BW
LMZ: https://docs.meine-schulplattform.de/xwiki/bin/view/Aktuelles%20und%20Serviceinformationen/21.10.2026%3A%20Sicherheitswarnung%20PHP%20%E2%80%93%20Ma%C3%9Fnahmen%20dringend%20empfohlen/

🚨 Rapid Response: Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), can allow unauthenticated remote code execution across multiple PHP server configurations.

Censys ARC observes:
🔸 2,580,515 Internet-exposed hosts and 54,888,147 web properties running PHP
🔸 1,575,688 hosts reporting PHP versions older than the fixed releases

These figures do not represent confirmed vulnerable systems. Security fixes may be backported without changing reported version strings.

PHP has released security updates and recommends upgrading immediately.

Full advisory and Censys queries: https://censys.com/advisory/cve-2026-109618-cve-2026-109619/

#CensysARC #Cybersecurity #VulnerabilityManagement #PHP #InfoSec

Important #CVE vulnerabilities affecting #PHP: https://cert.europa.eu/publications/security-advisories/2026-018/
php8.4 for #Debian has been updated today to 8.4.27:
```
php8.4 (8.4.27-1~deb13u1) trixie-security; urgency=high

* New upstream version 8.4.27
+ (CVE-2026-109618, CVE-2026-109619): Avoid state corruption via
bailout.

-- Ondřej Surý <ondrej@debian.org> Wed, 21 Oct 2026 09:53:46 +0200
```
And my personal server quickly updated with just a simple: apt update && apt upgrade

Thanks @ondrej!!

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP. While the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.

https://vulnerability.circl.lu/bundle/bba240d0-7dfe-4f4f-94be-d6b640ddbc0e

#vulnerability #php

🔧 Dočasně vypínáme podporu přes FreeScout (helpdesk.oscloud.cz) kvůli kritické chybě v PHP. Znovu ji zapneme po aplikování opravy.

⚠️ Kritická zranitelnost v PHP, co to znamená pro OSCloud

PHP tým oznámil dvě kritické chyby (CVE-2026-109618 a CVE-2026-109619, obě CVSS 9.2). Mohou umožnit spuštění cizího kódu na serveru bez přihlášení. Oprava vychází dnes v 16:00 SEČ/CEST. Podle hlášení bezpečnostních firem už probíhají první útoky.

Kterých služeb se to týká:
• Nextcloud, WordPress, Pixelfed, FreeScout, a další aplikace postavené na PHP
• LAMP weby zákazníků (Apache + PHP), včetně těch, kde zatím běží jen úvodní stránka

Kterých ne:
• Mastodon, Matrix, PeerTube, Gitea (PHP nepoužívají)
• Weby a úložiště na statických souborech (Surfer)

Co děláme:
• FreeScout jsme vypnuli
• Další PHP aplikace a LAMP weby budeme vypínat postupně a vždy o tom budeme informovat zde. Počítejte s tím, že dočasně vypneme i Nextcloud, a to do vydání a nasazení opravy
• Jakmile budou dostupné opravené verze aplikací, nasadíme je co nejdřív
• Před vypnutím a updaty děláme zálohy

Co to znamená pro vás:
• Podpora přes FreeScout je do opravy nedostupná
• Nextcloud, LAMP weby a další PHP služby mohou být dnes nedostupné
• Pokud by se při updatu něco pokazilo, vracíme se ze zálohy maximálně 12 hodin zpět

Opravu nelze řešit pluginy ani updatem WordPressu, musí přijít nové PHP v rámci aktualizace aplikace. Pokud provozujete vlastní PHP web mimo OSCloud, aktualizujte PHP hned, jak vyjde oprava.

Děkujeme za trpělivost. Stav budeme průběžně aktualizovat v tomto vlákně.

#OSCloud #PHP #Bezpečnost

All affected users must patch against php2shell (CVE-2026-109618 / CVE-2026-109619). Due to the nature of some of the primitives involved, ASLR is not effective and arbitrary code execution/reuse/filesystem-level execution isn't a necessary component of exploitation in this case.

php2shell (CVE-2026-109618 and CVE-2026-109619) – PHP critical vulnerability fixes available | Ubuntu https://ubuntu.com//blog/php2shell-vulnerability-fixes-available

PHP has released emergency updates for two severe runtime vulnerabilities named PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2.

The flaws affect nearly all PHP versions back to PHP 5.4.

Researchers noted that AI assisted in turning old primitives into working exploits, while Cloudflare observed early attack attempts before patches shipped.

Fixes are included in versions 8.5.12, 8.4.27, 8.3.36…

https://en.hacks.gr/epeigoyses-enimeroseis-asfaleias-gia-tin-php-logo-sovaron-kenon/

#PHP #PHP2Shell #CVE2026109618 #WebDev

OK, sorted.

If you previously followed my example and ran #shotshare (https://www.bentasker.co.uk/posts/blog/general/deploying-shotshare-into-kubernetes.html) you're likely to be vulnerable to #php CVEs CVE-2026-109618 and CVE-2026-109619

Upstream looks to be abandoned, so I've forked and reworked the docker image to consume the fix (PR against upstream: https://github.com/mdshack/shotshare/pull/87)

In the meantime, I've pushed to my registries

* codeberg.org/bentasker/shotshare:202610-php-cve-bump
* bentasker12/shotshare:202610-php-cve-bump

Should be drop-in replacements

Id-SIRTII/CC just released (an hour ago) a security advisory regarding php2shell.

You can access the details here:
https://idsirtii.bssn.go.id/publications/advisories/security-advisory-kerentanan-pada-php2shell-cve-2026-109618-cve-2026-109619

@indonesia

#cybersecurity #infosec #indonesia #indonesiaNews #php2shell

I've temporarily blocked connections to Instafops.net and a few other sites that I host that use PHP. I've put up 503 pages and a 307 Redirect on the impacted websites.

The WordPress sites will probably be back tomorrow, Instafops may take a few days depending on docker image updates.

Apologies for any inconvenience this may cause.

#FediAdmin #PHP #cve2026109618 #cve2026109619 #pixelfed

PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #RCE #ExploitedInTheWild #PoC #CyberSecurity

https://securityonline.info/php2shell-exploited-poc-public/?utm_source=mastodon&utm_medium=jetpack_social

Updates to Nextcloud package to fix CVE-2026-109618 and CVE-2026-109619 are out. Please update ASAP.

Kritisches PHP-Sicherheitsproblem: Websites offline

Sogar das BSI hat schon eine dringende Warnung veröffentlicht. Etwas hilfreicher ist der Text von Brian Krebs. Die besten und vor allem aktuellen Informationen gibt es beim SANS-ISC.
Beim jetzigen Kenntnisstand stellt sich die Lage so dar: In der FOSS Programmiersprache PHP wurden zwei Sicherheitslücken gefunden, die jetzt die Nummern CVE-2026-109618 und CVE-2026-109619 erhalten haben. Die zugrunde liegenden Schwachstellen existieren schon seit der Steinzeit, aber bisher war ihre eventuelle Ausnutzung so kompliziert, dass sie keine Gefahr darstellten. Mit Auftreten der KI hat sich das geändert. ... Weiterlesen:

https://www.pc-fluesterer.info/wordpress/2026/10/21/kritisches-php-sicherheitsproblem-websites-offline/

#0day #cms #exploits #KI #provider #sicherheit #vorbeugen #wissen

Nothing here for PHP2Shell

On Wednesday PHP shipped emergency releases for two flaws in its core, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. A single request from somebody who never logged in can be enough to run code on the web server, and every PHP…

https://blogsh.app/posts/2026/nothing-here-for-php2shell/

#security #philosophy

🚨 Critical pre-authentication RCE research published for two PHP core vulnerabilities; CVE-2026-109618 + CVE-2026-109619

PoC: https://github.com/ikow/php2shell-poc

The flaws affect PHP's session.upload_progress handling and can be chained through session-file injection, memory corruption, or deserialization behavior to achieve remote code execution under specific application conditions.

CVSS: 9.2 Critical
Affected: PHP 5.4.0 through 8.5.11
Fixed: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12

The repository includes verification PoCs for session injection, a heap use-after-free, and handler-mismatch deserialization, along with a vulnerable Docker lab and detailed technical analysis.

The php2shell fix is out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Two critical bugs (CVSS 9.2), both remote code execution without authentication. mod_php has the highest risk, but PHP-FPM and other SAPIs are affected too. There are source backports for 7.4, 8.0 and 8.1.

Update, then do a full restart, not a reload.

Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

#PHP #InfoSec #CVE

Updates to Wordpress, FreeScout packages to fix CVE-2026-109618 and CVE-2026-109619 are out. Please update ASAP.

OpenAI udostępniło narzędzie (+skill) do weryfikacji, czy dany serwer ma podatną wersję PHP (CVE-2026-109618 + CVE-2026-109619).

Najprościej wywołać:
node phpcheck.js --local

Lokalnie wykrywa OK, ale zdalnie raczej jest bezużyteczne, bo czyta nagłówki HTTP w celu wykrycia wersji PHP, ale kto w obecnych czasach to eksponuje? 🤷‍♂️

Um 12 Uhr UTC haben wir heute alle PHP Instanzen abgeschaltet. Jetzt warten wir auf die Veröffentlichung der PHP-Fixes für CVE-2026-109618 und CVE-2026-109619. Eine erneute Freischaltung der PHP Instanzen wird nicht vor 16 Uhr UTC erwartet. #hosting #security #php2shell

🚨 If you run PHP (like most of the internet does), this one can’t wait: #PHP2Shell = 2 critical RCE flaws in PHP core leaked before the patch, with live attacks already reported.

Because CVE-2026-109618 & CVE-2026-109619 sit in PHP itself, every app on a vulnerable PHP version is exposed, no matter what runs on top.

That’s why we’re building detection in our Network Scanner + an exploit module in Sniper as you’re reading this. Stay tuned for the launch announcement!

What to do now:

Inventory every PHP install, including control panels, vendor appliances, and Windows software that bundles its own php-cgi.exe
Patch as soon as PHP’s release is out, then restart PHP-FPM or your web server
On PHP 8.1 or older? No fix is coming. Upgrade, or take those systems off the internet
Alert on PHP processes spawning shells, interpreters, or download tools

#OffensiveSecurity #Pentesting #VulnerabilityManagement #EthicalHacking

Faille #PHP:
https://loud-technology.com/insight/faille-rce-php-cve-2026-109618-cve-2026-109619/

"Toutes les installations PHP qui servent des requêtes web sont concernées : PHP-FPM, Apache mod_php, php-cgi, FrankenPHP et LiteSpeed.

Le risque est maximal avec (Apache) mod_php, pour lequel un exploit fonctionne avant même l’exécution du code applicatif.

Selon l’équipe sécurité de PHP, aucune configuration ne remplace la mise à jour."

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

#php #CISA #CVE

PHP has released emergency fixes for PHP2Shell (CVE-2026-109618, CVE-2026-109619), two critical memory safety flaws in the PHP runtime that can allow unauthenticated code execution.

Upgrade now to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

🔗 https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619

#PHP2Shell: Wie ein #Speicherfehler zur #Shell wird.

CVE-2026-109618:

https://www.cve.org/CVERecord?id=CVE-2026-109618

CVE-2026-109619:

https://www.cve.org/CVERecord?id=CVE-2026-109619

https://youtube.com/watch?v=qXv8NAIFm9o

"Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed" 🤔 🕵️

https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html

#CVE2026109618 #CVE2026109619 #php #php2shell #exploit #cybersec #infosec

PHP reported two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution.

All PHP-powered websites (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed) are at risk.

Affected: 8.5.x < 8.5.12; 8.4.x < 8.4.27; 8.3.x < 8.3.36; 8.2.x < 8.2.35; 8.1 and older.

⚠️ PoCs circulate. Patch now; if unable, isolate internet-facing apps until fixed!

See: https://cert.europa.eu/publications/security-advisories/2026-018/

#security #hacking #foss #opensource #web #programming #coding

Critical CVE vulnerabilities were announced yesterday for PHP (CVE-2026-109618 and CVE-2026-109619). We have promptly responded to that and all servers in the #TDE infrastructure have already been updated.

Der Patch sitzt. Die Frisur auch: Kritische Schwachstellen in PHP (CVE-2026-109618 und CVE-2026-109619).

#Nerdkram #Exploit

Hätte es ja gut gefunden, wenn mein Hoster mir irgendwas geschickt hätte. Oder es auf der Webseite Infos gegeben hätte. Nichts zu
(CVE-2026-109618) (CVE-2026-109619). Dabei ist das doch ein super Thema, um den Kunden klar zu machen: Wir haben das auf dem Schirm, wir arbeiten da dran, das ist unser Job und wir nehmen ihn ernst.

Oder verstehe ich hier was nicht?

Well, so far I have not been able to obtain PHP updates for Fedora 42, 43, and 44.

I am using this as a script:

#!/bin/bash

sudo dnf clean all
sudo dnf check-update php
sudo dnf update php\*

sudo dnf update

sudo systemctl restart php-fpm
# If using Apache:
sudo systemctl restart httpd
# If using Nginx:
# sudo systemctl restart nginx

rpm -q --changelog php-cli | grep -E "CVE-2026-109618|CVE-2026-109619"

La faille nommée « php2shell » regroupant 2 vulnérabilités critiques PHP (CVE-2026-109618 et CVE-2026-109619) est bien en cours de correction ou mitigation sur les serveurs que nous infogérons. Plus d'informations sur https://www.php.net/index.php#2026-10-20-1 et https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC #php2shell

@php vuln is up:
https://www.php.net/archive/2026.php#2026-10-21-5
https://www.php.net/ChangeLog-8.php#8.5.12

CVE-2026-109618 CVE-2026-109619

The PHP security team has released the patch for CVE-2026-109618 and CVE-2026-109619. Our team is now updating Passbolt Cloud and the self-hosted images (Docker, OVA, DigitalOcean). Passbolt Cloud will be restored once the update is deployed and verified.

Regarding PHP2shell (CVE-2026-109618 and CVE-2026-109619) vulnerability, you obviously need to patch as quickly as possible but Cloudflare has implemented some mitigation's in it's default firewall that might buy you some time. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Wenn statt Eurer Webseite grad das hier auftaucht,
wird im besten Fall nur deren Server mit dem richtigen Patch (Update) versehen

CVE-2026-109618
CVE-2026-109619

bzw

GHSA-w8hw-w9fx-j79w,
GHSA-6wmf-4rv5-p3rp

#php2shell

watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.

https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

#eitw #php #php2shell #CVE

Security advisory: patches for #PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

https://community.opalstack.com/d/1729-security-advisory-patches-for-php2shell-cve-2026-109618-cve-2026-109619

2/2 - Critical PHP Vulnerabilities

"The PHP Foundation detailed the two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—which impact 'all PHP installations serving web requests' going back to PHP version 5, released in July 2004. However, only PHP 8.2 and newer are still supported and will receive patches, according to the alert. The PHP Foundation noted...ubiquitous and foundational web layers like PHP can persist forgotten and un-updated in historic internet infrastructure."

Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:

The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Ubuntu has released security updates for php2shell (CVE-2026-109618 and CVE-2026-109619), a critical issue rated 9.2 on CVSS 4.0 that can allow remote code execution in PHP applications without authentication.

Updates cover Ubuntu 14.04 LTS through 26.10; Ubuntu Pro is required for 14.04, 16.04 and 18.04 LTS.

The separate eMudhra certificate issue could allow fake certificates if compromised.

Google, Microsoft, Apple and Mozilla…

https://en.hacks.gr/i-ubuntu-diorthonei-dyo-provlimata-asfaleias-se-efarmoges-php-kai-pistopoiitika-emudhra/

#Ubuntu #PHP #eMudhra #CVE2026109618

‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online.

Researchers report potential RCE.

CVE-2026-109618 and CVE-2026-109619.

Fixes scheduled for October 21, 14:00 UTC.

Details - https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

PHP Fixes Land as Attacks Surge, Plus 2 Stories https://raymondtec.com/2026/10/php-security-update-attacks-surge-plus-2-stories/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief

PHP fixes are available as exploitation attempts surge. Also: Meta faces a $25 billion privacy judgment, and data-center companies promise fewer secrets.

#TechNews #CVE2026109618 #CVE2026109619 #DataCenters #Meta #PHP #privacy

Oh my!

I’m curious about this. I wonder if this is something… useful?

https://cyberplace.social/@GossiTheDog/117474220875882526

#php #cve2026109618 #cve2026109619

⚠️ Vorsichtsmaßnahme: Verschiedene Webseiten und zentrale Webanwendungen vorübergehend abgeschaltet.

Aufgrund kurzfristig bekannt gewordener Sicherheitslücken in der weit verbreiteten Programmiersprache PHP müssen wir am heutigen Mittwoch, 21. Oktober 2026, vorsorglich verschiedene Websites und zentrale Dienste der Universität Freiburg abschalten, um unsere IT-Systeme und Daten zu schützen. Verschiedene Angebote werden daher vorübergehend nicht erreichbar sein.

Die Sicherheitslücken betreffen grundsätzlich alle Einrichtungen und Organisationen weltweit, die PHP-basierte Systeme einsetzen. Die PHP Foundation hat für heute Nachmittag Sicherheitsupdates angekündigt, mit denen die Schwachstellen behoben werden sollen. Sobald diese verfügbar sind, wird das Rechenzentrum der Universität die Updates einspielen und die Dienste überprüfen, damit die betroffenen Angebote schnellstmöglich wieder sicher bereitgestellt werden können.

Welche Websites und Webdienste betroffen sind und wann sie wieder zur Verfügung stehen, erfahren Sie auf dieser Seite, die wir regelmäßig aktualisieren: https://www.rz.uni-freiburg.de/de/rz/aktuell/stoerungen/2026-10-21-10-39-massnahme-im-zusammenhang-mit-der-kritischen-schwachstelle-php-cve-2026-109618-und-cve-2026-109619

#ufr_störung

I follow the updates on the status :
https://loud-technology.com/insight/faille-rce-php-cve-2026-109618-cve-2026-109619/

Auf Grund der schwerwiegenden PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 sind meine Websites aktuell und für mehrere Stunden nicht erreichbar.

PHP2Shell (CVE-2026-109618, CVE-2026-109619): Zwei kritische RCE-Lücken in PHP und was getan werden muss

Wir werden das laufend aktualisieren ...

https://mint-secure.de/php2shell-kritische-rce-luecken-php/

https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619/38

If you use pfSense, you can run a command to force an update for the php issue. Granted this is a small vector of attack, as your webgui should be secure.

Warning though, it will kill any wireguard connections for a bit, as there is also a wireguard update.

Lets face it, PHP Enthusisasts always kinda are dorks. Kinda.

Instagram: @programmersarealsohuman

#CVE-2026-109618, #CVE-2026-109619 #DEVSECOPS #INFOSEC

PHP fixed two remote code execution flaws today, CVE-2026-109618 and
CVE-2026-109619. Anything serving PHP is affected, whatever sits on top of it.

Two steps, and the second is missing from most of the advice going round:

1. Update PHP. 8.5.12, 8.4.27, 8.3.36, 8.2.35, or your distro's backport.
2. Restart PHP. A pool loads its binary once and serves from it until it
restarts, so the fix on disk reaches nothing already running.

PHP 8.1 is past end of life and gets no fix. Move those sites.

📰 Critical PHP2Shell RCE Flaws Leaked Ahead of Coordinated Patch

🚨 CRITICAL: Two RCE flaws in PHP dubbed "PHP2Shell" (CVE-2026-109618, CVE-2026-109619) were leaked before patches. Affects PHP 5.4+. Active exploitation is confirmed. Prepare for emergency patching now! #PHP #RCE #CyberSecurity

🔗 https://cyber.netsecops.io/articles/critical-php2shell-vulnerabilities-leaked-ahead-of-patch/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

📰 Critical RCE Vulnerabilities in PHP Affect Millions of Web Servers

Two critical RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) in PHP with a 9.2 CVSS score. PoC exists. Over 22M instances exposed. Patching is urgent. #PHP #Vulnerability #CyberSecurity #RCE

🔗 https://cyber.netsecops.io/articles/critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is a pair of critical RCE bugs in the PHP engine itself, not WordPress or plugins. A single unauthenticated request can lead to remote code execution. Fixed versions released 21 Oct: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 update nd restart PHP workers (php-fpm/mod_php). PHP ≤8.1 has no fix, requires upgrade.
Shared hosting? Ask your host to confirm patch.
No confirmed mass compromise per CISA as of 21 Oct, but active probing reported. #php #cyberSecurity

There are protections out there to help you buy time to patch all your systems for #php2shell

#Checkpoint #WAF and IPS both catch and prevent this attack

https://blog.checkpoint.com/security/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619

Workaround for 2 critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), disclosed on October 21, 2026

https://www.synoforum.com/threads/workaround-for-2-critical-vulnerabilities-in-the-php-engine-cve-2026-109618-and-cve-2026-109619-php2shell-disclosed-on-october-21-2026.16429/

#synoforum #synology #NAS

PHP2Shell: due RCE non autenticate nel runtime PHP, CVE-2026-109618 e CVE-2026-109619, CVSS v4 9.2. Colpite quasi tutte le versioni (fino alla 5.4), mod_php il caso peggiore. Fix: 8.5.12, 8.4.27, 8.3.36, 8.2.35, backport 7.4/8.0/8.1. Cloudflare e watchTowr riportano tentativi di sfruttamento, nessuna compromissione confermata. Aggiornare il runtime e riavviare Apache/FPM: il CMS non basta. Mitigazione parziale: session.upload_progress.enabled=0. https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w #infosec #PHP

PHP2Shell : les correctifs de sécurité sont là, les attaques aussi ! https://www.it-connect.fr/php2shell-correctifs-urgence-cve-2026-109618-cve-2026-109619/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #PHP

Amazon Threat Intelligence and security firms detected exploit attempts targeting PHP core flaws CVE-2026-109618 and CVE-2026-109619.

The CVSS 9.2 rated vulnerabilities allow pre-authentication remote code execution across PHP 7.x and 8.x releases.

Following an early leak of details and proof-of-concept exploits, the PHP Foundation advanced the release of fixes by one day.

https://en.hacks.gr/sovara-kena-asfaleias-stin-php-epitrepoyn-apomakrysmeni-ektelesi-kodika/

#PHP #CVE2026109618 #Vulnerability #Patch

QNAP PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect QTS, QuTS hero and apps. No patch yet, so take NAS devices offline.

#QNAP #PHP2Shell #QTS #CVE2026109618 #CVE2026109619 #NAS #RCE #CyberSecurity

https://securityonline.info/qnap-php2shell-vulnerabilities-qts/?utm_source=mastodon&utm_medium=jetpack_social

Netcraft/NCSC reaching out to any email address they can find. I host my friend's wordpress blog and he got it to the info@ address as well as me getting it to webmaster@

Issue [#REDACTED]: Potentially vulnerable web application at hxxp://[REDACTED]

Hello,

On behalf of the National Cyber Security Centre (NCSC), we have identified software on your network that may be vulnerable and require remedial action.

The NCSC's mission is to make the UK the safest place to live and work online and as part of its Proactive Notification service, we are writing to alert you to a potential security issue that could be exploited by malicious actors.

This notification is based on our scanning of open-source information, such as publicly available software versions. The service was launched to responsibly report vulnerabilities to system owners to help them protect their services. If you are not the owner of this site, please ensure every effort is made to forward this email onto the webmaster.

The presence of this vulnerability may result in a criminal gaining unauthorised access to, leaking data from or otherwise disrupting your servers. Please follow the remediation steps listed below to address the vulnerability as soon as possible.

* Remote Code Execution in PHP (CVE-2026-109619)

hxxp://[REDACTED] [IP REDACTED]

Your PHP server has two critical remote code execution vulnerabilities (CVE-2026-109618 & CVE-2026-109619).

Successful exploitation could allow an attacker to compromise the server, deploy ransomware, steal data, or attack other machines on the network.

Update your PHP installation to at least one of the following versions immediately:

* 8.5.12

* 8.4.27

* 8.3.36

* 8.2.35

See https://www.php.net/archive/2026.php#2026-10-21-5 for more information about these vulnerabilities. This includes instructions on other measures to reduce your exposure if you can't update immediately.

Sign up for more notifications:

    Every day, UK organisations are targeted by cyber criminals – whether for their data, their funds, or simply to cause disruption. Early Warning is a free service from the NCSC that notifies organisations of potential cyber threats before they cause harm. By signing up, you will receive timely alerts about malicious activity targeting your network – giving you the chance to take action early and reduce risk.

    The more information you share with the NCSC Early Warning service about your IT estate, the more effectively monitoring can be tailored, ensuring you receive relevant, actionable notifications.

    Paste this link in your browser to visit the Early Warning webpage to find out more and to sign up: https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning?referrer=ProactiveNotificationService

    The NCSC website offers a wide range of guidance, tools and services to help organisations strengthen their cyber security. Whether you're a small business, a large enterprise, a charity, or part of the public sector, there is practical advice to help you protect your systems, data and people.

About this email:

    The NCSC has engaged Netcraft to send notifications to organisations identified to be running software with known vulnerabilities, as part of the NCSC's mission to increase the UK's cyber resilience:

    You are ultimately responsible for the security of your own networks and data, and for determining the steps that you take to protect yourself. This includes identifying and addressing vulnerabilities in your systems: this notification service does not cover all systems or vulnerabilities, so you must not rely on it as your sole source of alerts.

    You are also best placed to appreciate the wider implications of our advice for the rest of your business, and it is for you to determine whether and how to implement our recommendations.

    The NCSC processes your personal data in accordance with its privacy policy. For more information and your rights see https://www.ncsc.gov.uk/section/about-this-website/privacy-statement

More information about the detected issue is provided at https://incident.netcraft.com/reports/[REDACTED]
See https://incident.netcraft.com/about for more details including API support.

Kind regards,

Netcraft

Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: [REDACTED]

To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: support@netcraft.com.

Kudos to #Ubuntu for moving so quickly to deploy patched versions of relevant packages for the OS. Same for every other Linux distro that hustled before the announcement of this critical flaw in PHP, which is now being addressed by system admins everywhere.

php2shell (CVE-2026-109618 and CVE-2026-109619) – PHP critical vulnerability fixes available | Ubuntu

https://ubuntu.com/blog/php2shell-vulnerability-fixes-available

A cPanel PHP update fixes PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, while WP Toolkit 6.11.5 patches CVE-2026-107663.

#cPanel #PHP2Shell #WPToolkit #CVE2026109618 #CVE2026109619 #CVE2026107663 #WebHosting #CyberSecurity

https://securityonline.info/cpanel-php-update-php2shell-wp-toolkit/?utm_source=mastodon&utm_medium=jetpack_social

En las últimas 24 horas, se corrigieron vulnerabilidades críticas en GitLab y Node.js que permiten ejecución remota de código, mientras una nueva herramienta de alta precisión detecta fallos PHP2Shell y OpenAI impulsa la identificación avanzada de fallos en PHP, demostrando la urgente necesidad de actualizar y fortalecer seguridad en entornos web. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:

🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 22/10/26 📆 |====

🔓 VULNERABILIDAD CRÍTICA EN GITLAB AFECTA 12 AÑOS DE VERSIONES

GitLab ha corregido una falla crítica (CVE-2026-110264) que permite la ejecución remota de código sin autenticación en versiones autogestionadas desde la 7.0. Esta vulnerabilidad con puntuación CVSS 10.0 representa un riesgo extremo para entornos empresariales y desarrolladores que utilizan esta plataforma. Es fundamental actualizar GitLab a la última versión para proteger sus sistemas contra posibles ataques remotos que podrían comprometer la integridad y disponibilidad de datos.
Proteja su infraestructura actualizando GitLab ahora y conozca más detalles aquí 👉 https://djar.co/WhTgv

🛡️ NUEVA HERRAMIENTA DE ALTA FIDELIDAD PARA DETECCIÓN DE PHP2SHELL

Se ha lanzado php2shell-scanner, una herramienta de código abierto que permite detectar con alta precisión las vulnerabilidades CVE-2026-109618 y CVE-2026-109619 en servidores que utilicen PHP. Estas fallas son explotadas para ejecutar código malicioso y comprometer sistemas. Esta solución de detección mejora la seguridad al facilitar auditorías rápidas y confiables para mitigar riesgos antes de que se produzcan incidentes.
Descargue y utilice php2shell-scanner para fortalecer la defensa de sus servidores visitando 👉 https://djar.co/VZN4pj

⚠️ RCE CRÍTICA EN NODE.JS POR FALLO EN DECODIFICADOR BROTLI

Node.js presentó una vulnerabilidad grave (CVE-2026-111497) que afecta las versiones 22, 24 y 26, permitiendo ejecución remota de código a través del decodificador Brotli. Vercel activó reglas en su Web Application Firewall para bloquear patrones de explotación conocidos, pero enfatizan que la única solución segura es actualizar a las versiones 22.23.4, 24.22.1 o 26.12.1. Este aviso es esencial para desarrolladores y administradores que utilicen Node.js en producción para evitar compromisos que afecten aplicaciones web.
Actualice Node.js y revise las recomendaciones de seguridad de Vercel aquí 👉 https://djar.co/zoOOY7

🤖 OPENAI IMPULSA EL DESCUBRIMIENTO DE FALLOS CRÍTICOS EN PHP

Gracias al apoyo de modelos avanzados de IA proporcionados por OpenAI, investigadores de la iniciativa "Patch the Planet" han identificado vulnerabilidades críticas en PHP, el lenguaje que impulsa cerca del 70% de las aplicaciones web en todo el mundo. Este hallazgo es vital para la comunidad de desarrolladores y responsables de seguridad, pues permite anticipar y corregir fallas que podrían ser aprovechadas por atacantes a gran escala. El uso de inteligencia artificial en seguridad sigue transformando la detección y mitigación de amenazas.
Conozca cómo OpenAI está revolucionando la seguridad en PHP visitando 👉 https://djar.co/OabJE