Security firm Calif uncovered two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale, that allow unauthenticated remote code execution via memory corruption and stale global state issues. WatchTowr researchers confirmed they could reproduce both flaws after a proof-of-concept tool called PHP2Shell leaked ahead of a planned coordinated disclosure, and PHP's maintainers have released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
darkreading.com
· 2026-10-21
PHP's maintaining agency disclosed two critical vulnerabilities on Tuesday, with fixes scheduled for release Wednesday at 10 a.m. ET. The flaws, rated 9.2 out of 10 in severity, could let attackers compromise websites built on PHP, which the Wall Street Journal estimates powers 70% of the internet. Agencies including the NSA and UK's NCSC urged administrators to patch immediately or take sites offline, while Cloudflare said it had deployed a firewall fix and security firm watchTowr reported early signs of exploitation attempts.
cnet.com
· 2026-10-21
PHP developers issued an advisory disclosing two vulnerabilities rated 9.2 out of 10 in severity, affecting every PHP version since PHP 5. A patch was expected to be released Tuesday at 10AM ET, with developers urging immediate upgrades once available, and some agencies suggesting affected systems go offline if patching isn't possible right away.
theverge.com
· 2026-10-21
PHP maintainers announced Monday that patches for two vulnerabilities, each rated 9.2 out of 10 in severity, would be released within about 12 hours. The advisory followed leaked, unconfirmed details of an exploit tool called PHP2Shell demonstrated against popular PHP-based platforms including WordPress, Magento, Drupal, and Joomla. Security firm watchTowr said the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, appear to affect every PHP version since PHP 5 in 2004 and that it has confirmed they are genuine.
arstechnica.com
· 2026-10-21
Citrix patched eight NetScaler vulnerabilities, including two actively exploited zero-days, after researchers reported RCE attacks scanning for vulnerable installations and urged customers to take systems offline immediately. Citrix instead advised customers to upgrade promptly rather than disconnect servers, and the two zero-days continued to be exploited despite the patch. Separately, Kiteworks told customers to proactively take systems offline based on intelligence of an imminent attack before confirming the next day that only about 1% of customers were actually affected.
darkreading.com
· 2026-10-02
Citrix disclosed CVE-2026-88771 and CVE-2026-88772, both scoring 9.5 on the CVSS scale, affecting default configurations of its NetScaler ADC and Gateway products. Citrix confirmed exploits against unmitigated deployments and urged customers to patch immediately, though public warnings of attacks had circulated online since September 25, days before the formal disclosure.
darkreading.com
· 2026-09-29
Citrix administrators report being privately contacted by IT suppliers, law enforcement, and cybersecurity agencies warning of two unpatched NetScaler remote code execution vulnerabilities being exploited in the wild. Security firm watchTowr confirmed the flaws are distinct from CVE-2026-19490 and CVE-2026-19489 disclosed in August, and said patches are expected next week.
bleepingcomputer.com
· 2026-09-27
CISA has added a maximum-severity GitLab vulnerability, CVE-2026-85706, to its known exploited vulnerabilities catalog after security firm watchTowr detected attackers scanning the internet for unpatched servers. The flaw allows unauthenticated attackers to read credentials and sensitive files from GitLab instances via a single crafted HTTP request to the repository commits API. GitLab patched the issue in versions 19.3.2, 19.2.6, and 19.1, but federal agencies now have just three days to remediate under a binding directive.
bleepingcomputer.com
· 2026-09-14
A critical authentication bypass, CVE-2026-82329, in self-managed JFrog Artifactory deployments is being actively exploited to mint fraudulent administrator tokens without any prior authentication. The flaw sits in Artifactory's default configuration, and watchTowr researchers say attackers are already using it in the wild. JFrog patched the issue on August 28 across several version branches, and confirmed its cloud-hosted environments were never at risk.
bleepingcomputer.com
· 2026-09-02
CISA has added CVE-2026-8452, a memory overflow bug in Citrix NetScaler ADC and Gateway appliances, to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to patch by August 29. Originally described by Citrix as only enabling denial-of-service, researchers at watchTowr later demonstrated it can be exploited for root-level remote code execution, and reports indicate attackers are already deploying web shells on unpatched systems.
bleepingcomputer.com
· 2026-08-27
GoKawiil