Results for "CVE-2026-109619"
Fri, October 23
Informational advisory: Session upload progress
We suggest you set until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed. session.upload_progress.enabled=0 GHSA-6wmf-4rv5-p3rp The issue can only occur under an unusual combination of configuration and application code. An application must set to or in its configuration and then switch it to at runtime with before calling . Session upload progress must also still be enabled. App…
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote
Thu, October 22
Wed, October 21
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution. The post PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws appeared first on SecurityWeek .
PHP 8.5.12 Released!
The PHP development team announces the immediate availability of PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.5.12 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.27 Released!
The PHP development team announces the immediate availability of PHP 8.4.27. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.4 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.4.27 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.36 Released!
The PHP development team announces the immediate availability of PHP 8.3.36. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.3 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.3.36 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.2.35 Released!
The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version. For source downloads of PHP 8.2.35 pleas…