Shadowserver reports more than 1,000 internet-facing GitLab servers remain vulnerable to CVE-2026-97229, a critical integer overflow bug in GitLab's CI/CD Regular Expression Compiler that lets unauthenticated attackers run arbitrary code via crafted regex in pipeline configs. GitLab shipped fixes on October 12 in versions 19.4.2, 19.3.5 and 19.2.8, but CISA has now confirmed active exploitation and added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until Sunday to patch.
bleepingcomputer.com
· 2026-11-02
CISA has confirmed active exploitation of two critical PHP vulnerabilities, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated attackers to achieve remote code execution on unpatched systems. PHP issued patches on October 21, and CISA has ordered federal civilian agencies to secure their systems by Thursday under Binding Operational Directive 26-04.
bleepingcomputer.com
· 2026-10-27
Security researchers confirmed successful exploitation of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), just days after patches shipped and earlier exploitation attempts had failed. Adel Karimi of Perplexity reported honeypot evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26, including an 800 KiB decoded cookie dump and a function address matching a public exploit's offsets appearing in the execution payload. Expel researcher Marcus Hutchins corroborated the finding, calling it the highest-quality confirmation of in-the-wild exploitation seen so far.
yro.slashdot.org
· 2026-10-26
A hacker breached an intentionally vulnerable server running unpatched PHP software, claiming a Bitcoin bounty posted on the Steal My Bitcoin website. The prize, initially worth around $502, grew through donations to 0.02511679 BTC ($2,021.22) before being claimed at 15:47 UTC on October 25, about 19.28 hours after the challenge began. The creator, 'cloudlandsdev', set up the test to see if the recently disclosed CVE-2026-109618 and CVE-2026-109619 PHP vulnerabilities, patched on October 21, could actually be exploited in practice.
tomshardware.com
· 2026-10-26
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 in severity, affect most PHP builds and were patched by the PHP Project on Wednesday. Security firm Wiz, which found the flaws with AI assistance, says PHP runs on roughly 70% of websites worldwide, and the bugs allow memory disclosure and unauthenticated remote code execution independent of the application running on PHP.
zdnet.com
· 2026-10-23
The PHP team released PHP 8.6.0 RC4, the third release candidate in the 8.6 cycle, which patches two critical vulnerabilities that could allow unauthenticated remote code execution. Users running earlier 8.6.0 builds are urged to update immediately, though the team stresses RC4 remains a test build not meant for production use. A further release candidate, RC5, is planned for 5 November 2026.
php.net
· 2026-10-23
Amazon Threat Intelligence reports that attackers began targeting the two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on October 17, four days before PHP released fixes on October 21. The PHP team had to move up its disclosure timeline after details including the CVE IDs and mitigation guidance leaked online two days early, and researchers say functional exploits appeared within hours of the patch release.
bleepingcomputer.com
· 2026-10-22
Security firm Calif uncovered two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale, that allow unauthenticated remote code execution via memory corruption and stale global state issues. WatchTowr researchers confirmed they could reproduce both flaws after a proof-of-concept tool called PHP2Shell leaked ahead of a planned coordinated disclosure, and PHP's maintainers have released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
darkreading.com
· 2026-10-21
Researchers disclosed PHP2Shell, a set of memory-safety vulnerabilities in PHP's core, covering two CVEs related to out-of-memory corruption and stale global state persisting across requests. The flaws affect any site running vulnerable PHP versions, even simple applications with secure code, and are not tied to any specific CMS. WordPress, Drupal and Joomla were used only as demonstration targets for unauthenticated remote code execution, and the PHP team has released fixes.
php2shell.com
· 2026-10-21
The PHP project has released updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let unauthenticated attackers achieve remote code execution. The flaws stem from out-of-memory handling and stale global state issues affecting PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed deployments. PHP versions 8.1 and earlier no longer receive official fixes, so users on those versions must seek vendor backports or upgrade.
php.net
· 2026-10-21
Wiz Research disclosed multiple critical vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, which could let attackers remotely execute code, disclose memory, steal data or deface sites without authentication. PHP, which underpins roughly 70% of websites including WordPress, Joomla, Drupal and MediaWiki, has been affected since version 5.4, and a patch was released on October 21, 2026 following a coordinated cross-industry disclosure effort.
wiz.io
· 2026-10-21
The UK's National Cyber Security Centre, along with EU and Australian counterparts, has told organisations using PHP to install a critical update released by the PHP Foundation on Wednesday. Two vulnerabilities were identified that could allow unauthenticated remote code execution, potentially letting attackers install malware or disable websites. Officials say affected versions may stretch back as far as PHP 5, released in 2004.
bbc.co.uk
· 2026-10-21
GoKawiil