USN-8948-2: PHP vulnerabilities

USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handle...

USN-8948-2 php5, php7.0, php7.2, php7.4 vulnerabilities

USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handle...

CVE-2026-113788

Lagoon, an application delivery platform for Kubernetes, contains a Remote Code Execution vulnerability in the ssh service of Lagoon core affecting versions prior to 2.33.1 . An attacker with a valid Lagoon user account can execute arbitrary code, potentially gaining elevated administrative permi...

CVE-2026-113788 Lagoon core ssh service vulnerable to remote code execution

Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the ssh service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fa...

CVE-2026-113788 Lagoon core ssh service vulnerable to remote code execution

Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the ssh service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fa...

Widespread PHP Flaw May Cause Many Site Outages Today

Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these...

CVE-2026-109619

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

CVE-2026-109618

A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...

CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory OOM handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 sco...

Two critical RCEs in PHP core

Update 10/22: Added section detailing observations of in the wild exploitation and associated IoCs. Cisco Talos is tracking the disclosure of two unauthenticated remote code execution RCE flaws in PHP core, dubbed "php2shell", triggered by a plain HTTP request and exploitable before any applicati...

PHP2SHELL-POC

██████╗ ██╗ ██╗██████╗ ██████╗ ███████╗██╗ ██╗███████╗██╗...

Exploit for CVE-2026-109618

🛡️ Complete Report on the PHP "Upload Progress" Vulnerability...

CVE-2026-25053

CVE-2026-25053 Read: https://yadhu.in/2026/02/09/Breaking-Down-the-n8n-Git-Node-Vulnerability-CVE-2026-25053-Remote-Code-Execution/...

K000163821: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Security Advisory Description CVE-2026-109618 also known as php2shell PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before...

Exploit for CVE-2026-109618

CVE-2026-109618 Affected-Version Checker Non-destructive chec...

DEBIAN-CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...

AZL-109818 CVE-2026-109619 affecting package php for versions less than 8.3.35-2

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...

AZL-109815 CVE-2026-109618 affecting package php for versions less than 8.3.35-2

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

DEBIAN-CVE-2026-109618

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

CVE-2026-109618

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...