Exploit for Improperly Controlled Sequential Memory Allocation in Php

CVE-2026-109619 — PHP stale worker-global state "php2shell",...

CVE-2026-114439

The oretnom23 php-travel-agency-system is vulnerable to missing authentication within the Session Handler component, specifically affecting the admin/session.php file. An attacker can perform a remote attack by manipulating the user_id argument. While the exploit has been publicly disclosed, the ...

CVE-2026-114439 oretnom23 php-travel-agency-system Session session.php missing authentication

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument userid can lead to missing authentication. It is possible to launch t...

CVE-2026-114439 oretnom23 php-travel-agency-system Session session.php missing authentication

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument userid can lead to missing authentication. It is possible to launch t...

CVE-2026-114439 oretnom23 php-travel-agency-system Session session.php missing authentication

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument userid can lead to missing authentication. It is possible to launch t...

CLSA-2026-1792615126 php: Fix of 2 CVEs

CVE-2026-109618, CVE-2026-109619: disable the session upload progress handler and harden request state after bailout - memorylimit and allocation overflow fatals now print to stderr and terminate the process no bailout, no shutdown functions...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-detect Defensive Detector + Bounded Offensive I...

Exploit for CVE-2026-97629

CVE-2026-97629 — nginx TLS session-ticket forgery client-cert...

DEBIAN-CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

DEBIAN-CVE-2026-111815

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,...

CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

CVE-2026-111815

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,...

CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

CVE-2026-111815

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,...

UBUNTU-CVE-2026-111815

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,...

UBUNTU-CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

Exploit for CVE-2026-109618

php2shell - CVE-2026-109618 / CVE-2026-109619 Independe...

CLSA-2026-1792612051 php: Fix of 2 CVEs

CVE-2026-109618, CVE-2026-109619: disable the session upload progress handler and harden request state after bailout - memorylimit and allocation overflow fatals now print to stderr and terminate the process no bailout, no shutdown functions...

CLSA-2026-1792611997 php: Fix of 2 CVEs

CVE-2026-109618, CVE-2026-109619: disable the session upload progress handler and harden request state after bailout - memorylimit and allocation overflow fatals now print to stderr and terminate the process no bailout, no shutdown functions...

CLSA-2026-1792612092 Fix CVE(s): CVE-2026-109618, CVE-2026-109619

SECURITY UPDATE: remote code execution via state corruption after a bailout and via stale request-global state - debian/patches/CVE-2026-109618-CVE-2026-109619.patch: PHP security team's minimal mitigation for EOL branches: report allocator overflow and out-of-memory errors via zendmmsafeerrorex...