Php Foundation - GoKawiil

PHP Foundation issues emergency patches for two critical remote-execution flaws

The PHP Foundation released emergency updates on Wednesday to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let attackers remotely take control of affected systems. The flaws affect all PHP installations serving web requests dating back to PHP 5 from 2004, though only PHP 8.2 and newer will receive official patches, with some legacy fixes available through third-party vendors.

wired.com · 2026-10-21

PHP Foundation and eMudhra disclose critical security flaws affecting WordPress, Drupal, TLS certs

The PHP Foundation is rolling out patches for two vulnerabilities rated 9.2 out of 10 in severity, following reports of a tool called PHP2Shell that can run malicious code on servers using WordPress, Drupal, MediaWiki and other PHP-based platforms, reportedly affecting every PHP version since 2004. Separately, India-based certificate authority eMudhra disclosed that eight of its intermediate CA certificates—trusted by Mozilla, Microsoft, Apple and Chrome—have weak private keys that could let attackers forge credentials.

engadget.com · 2026-10-21