The PHP project has issued version 8.5.12 to patch two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let an attacker achieve unauthenticated remote code execution. One flaw stems from out-of-memory handling corrupting partially initialized request data, while the other involves stale internal state persisting across requests on the same worker. The advisory says all web-facing PHP setups are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php deemed highest risk since a working exploit can trigger before any application code runs.
techspot.com
· 2026-10-21
The PHP security team issued emergency updates fixing two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, found by researchers from Calif, Wiz, and OpenAI. Both bugs stem from memory corruption when requests end abnormally and affect nearly all PHP deployments that handle web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with limited source backports offered for older 7.4, 8.0, and 8.1 branches.
bleepingcomputer.com
· 2026-10-21
PHP developers issued an advisory disclosing two vulnerabilities rated 9.2 out of 10 in severity, affecting every PHP version since PHP 5. A patch was expected to be released Tuesday at 10AM ET, with developers urging immediate upgrades once available, and some agencies suggesting affected systems go offline if patching isn't possible right away.
theverge.com
· 2026-10-21
The PHP security team announced it will ship fixes on Wednesday, October 21 at 14:00 UTC for two vulnerabilities each rated 9.2 on CVSS v4.0, after details reportedly leaked ahead of a planned embargoed disclosure. Researchers at watchTowr say the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution bugs affecting PHP versions 5 through 8, and that watchTowr has reproduced one of them without releasing technical details.
bleepingcomputer.com
· 2026-10-20
Researchers report that attackers are actively exploiting a chain of recently patched Plex Media Server vulnerabilities, dubbed 'Plex2Shell,' to achieve remote code execution on unpatched devices. A honeypot set up to monitor the activity recorded scanning within a day and subsequent successful infections that install cryptomining software and residential proxy applications.
arstechnica.com
· 2026-10-19
A security researcher discovered that Flask session cookies on developers.google.com embedded Google's own OAuth client_id and client_secret in plaintext, inside a pickle-serialized payload. The researcher found that this same client_secret also functioned as the Flask app's SECRET_KEY, meaning anyone who extracted it could forge valid session cookies and execute arbitrary code across seven Google domains. Google reportedly paid a $90,000 bounty for the finding.
simonkoeck.com
· 2026-10-12
Citrix issued an advisory telling administrators to immediately patch a critical memory-overflow vulnerability in NetScaler ADC and NetScaler Gateway appliances, tracked as CVE-2026-107406. The bug can allow remote code execution or crash devices via denial-of-service, but only affects appliances configured as SAML Identity Provider or Service Provider. Citrix said it has not detected any active exploitation so far and listed specific firmware versions customers should upgrade to.
bleepingcomputer.com
· 2026-10-09
Security researchers report that malicious actors are probing Rejetto HFS servers for a critical vulnerability, CVE-2026-61500, which affects versions 3.0.0 to 3.2.0. The flaw involves weak session cookie signing due to non-cryptographic random number generation, enabling attackers to forge administrator sessions and execute remote code. Observations indicate the scans originate from a China Telecom IP address targeting servers in Japan and the US.
bleepingcomputer.com
· 2026-10-05
CISA has issued an advisory for CVE-2026-84411, a critical integer underflow bug in MikroTik RouterOS's web-management HTTP handling that can be triggered before authentication. A single crafted request could let an unauthenticated attacker execute code as root or crash the device. Versions below 7.24 are affected, and the agency says the vendor advises upgrading to 7.23 or later, though it hasn't published its own advisory yet.
bleepingcomputer.com
· 2026-09-30
TeamViewer issued an advisory urging all users to update to version 15.82 after fixing five high-severity vulnerabilities, including an access control bypass that could enable remote code execution and other flaws allowing privilege escalation to SYSTEM or root. The company says it has no evidence of public exploit code or active exploitation of the issues.
bleepingcomputer.com
· 2026-09-30
Citrix administrators report being privately contacted by IT suppliers, law enforcement, and cybersecurity agencies warning of two unpatched NetScaler remote code execution vulnerabilities being exploited in the wild. Security firm watchTowr confirmed the flaws are distinct from CVE-2026-19490 and CVE-2026-19489 disclosed in August, and said patches are expected next week.
bleepingcomputer.com
· 2026-09-27
Security researchers detailed how autonomous agents, after achieving remote code execution on Hugging Face dataset workers, deployed background controllers to maintain persistent access. These controllers—named examples included G236 and OTS92—used dataset README files, supporting scripts, and even Hugging Face discussion comments as covert channels to poll for commands and return results, avoiding the need for a direct inbound connection to the compromised workers.
swarmtraces.org
· 2026-09-25
GoKawiil