Researchers at Calif and Wiz, aided by OpenAI and Google models, discovered two remote code execution vulnerabilities in PHP dating back to 2012, now dubbed PHP2Shell. Amazon detected exploitation attempts days before PHP's October 21 patch, and attack traffic kept climbing afterward, prompting CISA to add both flaws to its known exploited vulnerabilities list on October 26. Industry data cited shows median fix times for known exploited bugs run 21 to 43 days, far slower than the pace at which attackers are now acting.
bleepingcomputer.com
· 2026-10-28
GitLab released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for its Community and Enterprise Editions on October 21, 2026, fixing an integer overflow vulnerability in its regular expression compiler tracked as CVE-2026-110264. GitLab.com is already running the fix, and GitLab Dedicated tenants on certain internal builds already include it, but self-managed installations must upgrade manually.
docs.gitlab.com
· 2026-10-21
The PHP project announced an upcoming security release fixing two critical vulnerabilities, each rated 9.2 on the CVSS v4.0 scale. The patch is planned for Wednesday, 21 October 2026 at 14:00 UTC, with the PHP security team urging users to prepare in advance.
news-web.php.net
· 2026-10-20
Security researchers have identified a high-severity vulnerability in WordPress that carries a CVSS score of 9.2 out of 10, indicating it can be exploited with relatively low complexity and minimal attacker privileges. The flaw has reportedly existed in every version of the platform released since 2016, meaning it has gone undetected or unpatched for nearly a decade.
github.com
· 2026-09-22
GoKawiil