Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Show: Network-relevant Vendor advisories CVE Government Industry Blog All Vendor: PHP (clear)
-
CISA adds CVE-2026-109619 to KEV: PHP Stale Internal Request-State Vulnerability
PHP Group PHP. PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based…
-
CISA adds CVE-2026-109618 to KEV: PHP Memory Corruption Vulnerability
PHP Group PHP. PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on…
-
There isn't an easy exploit for this PHP vulnerability
Article URL: https://eliastaylor.com/noexploit/ Comments URL: https://news.ycombinator.com/item?id=50188948 Points: 636 # Comments: 478
-
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Article URL: https://aws.amazon.com/security/security-bulletins/2026-143-aws/ Comments URL: https://news.ycombinator.com/item?id=50187708 Points: 118 # Comments: 26
-
Vulnerabilities in PHP Affecting Cisco Products: October 2026
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the a…
-
CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)
-
Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working e…
-
Critical Vulnerabilities in PHP Require Immediate Patching
Update October 26, 2026: CISA has updated this Alert to reflect the addition of CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 26, 2026. Update October 23, 2026: CISA has updated this Alert to: (1) provide a SIGMA detection ru…
-
PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)
Article URL: https://jackalsyn.com/posts/php-up-2026.html Comments URL: https://news.ycombinator.com/item?id=50176077 Points: 187 # Comments: 62
-
PHP warns it plans to release 2 emergency patches imminently
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.