334800 matches found
CVE-2026-109619
A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory OOM handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 sco...
Two critical RCEs in PHP core
Update 10/22: Added section detailing observations of in the wild exploitation and associated IOCs. Cisco Talos is tracking the disclosure of two unauthenticated remote code execution RCE flaws in PHP core, dubbed "php2shell", triggered by a plain HTTP request and exploitable before any applicati...
PHP2SHELL-POC
██████╗ ██╗ ██╗██████╗ ██████╗ ███████╗██╗ ██╗███████╗██╗...
Exploit for CVE-2026-109618
🛡️ Complete Report on the PHP "Upload Progress" Vulnerability...
K000163821: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
Security Advisory Description CVE-2026-109618 also known as php2shell PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before...
Exploit for CVE-2026-109618
CVE-2026-109618 Affected-Version Checker Non-destructive chec...
AZL-109815 CVE-2026-109618 affecting package php for versions less than 8.3.35-2
PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...
DEBIAN-CVE-2026-109618
PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...
DEBIAN-CVE-2026-109619
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...
AZL-109818 CVE-2026-109619 affecting package php for versions less than 8.3.35-2
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...
CVE-2026-109618
PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...
CVE-2026-109619
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...
[SECURITY] [DLA 4848-1] php8.2 security update
Debian LTS Advisory DLA-4848-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin October 21, 2026 https://wiki.debian.org/LTS Package : php8.2 Version : 8.2.35-1deb12u1 CVE ID : CVE-2026-109618 CVE-2026-109619 Two critical vulnerabilities were found in PHP, a...
vulnerabilities handled in PHP
PHP has two critical vulnerabilities. These vulnerabilities can be exploited without authentication to execute arbitrary code. All PHP installations that process web requests are affected. The vulnerability with the identifier CVE-2026-109618 involves memory corruption during the handling of an...
fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01)
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...
Exploit for CVE-2026-109618
Emergency Mitigation Measures for PHP CVE-2026-109618 / CV...
USN-8948-1 php8.1, php8.3, php8.5 vulnerabilities
It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. CVE-2026-109618 It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could u...
USN-8948-1: PHP vulnerabilities
It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. CVE-2026-109618 It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could u...
CVE-2026-109619
The PHP engine is vulnerable to a Use-After-Free (UAF) condition where global state may incorrectly persist or be repopulated after being freed, allowing subsequent requests to read or branch on stale memory. This flaw occurs because certain strategies can trigger a scenario where global state re...