PHP2Shell RCE vulnerabilities that can allow unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619)

The Brocade Product Security Team has become aware of two memory-safety vulnerabilities stemming from improper handling of fatal errors, specifically out-of-memory errors, during request processing in PHP. When a request terminates unexpectedly due to these errors, the internal PHP state can beco...

ALSA-2026:87071 Important: php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

ALSA-2026:87072 Important: php:8.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

ALSA-2026:87073 Important: php:8.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

ALSA-2026:87079 Important: php:8.3 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

ALSA-2026:87151 Important: php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

PT-2026-120812

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign, deepRef, and setNestedKey. The resultin...

PT-2026-120702

Name of the Vulnerable Software and Affected Versions Cisco products affected versions not specified Description A memory management issue exists in the Snort 3 Detection Engine due to incomplete error checking during file processing. This flaw can lead to unreleased memory, which an...

PT-2026-120545

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0 on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra stream id for every additional stream. The response...

PT-2026-120681

Name of the Vulnerable Software and Affected Versions Snort 3 affected versions not specified Description An issue involving out-of-bounds writes occurs in the software. Out-of-bounds write is a condition where the software writes data past the end, or before the beginning, of the intended buffer...

PT-2026-129110

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self. size without rerunning Image. decompression bomb check. A tiny file can use a safe first frame to pass Image.open and then declare very...

PT-2026-120178

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm processor kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel config values...

PT-2026-122476

Уязвимость микропрограммного обеспечения шлюза Cisco Expressway связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

Pillow resource management error vulnerability

Versions of Pillow from 11.2.1 up to but not including 13.0.0 contain a resource management error vulnerability. This vulnerability arises because Arrow assumes that image rows are tightly packed and exports them from im-blocks0.ptr. It fails to properly handle row padding or alignment offsets...

Linux Distros Unpatched Vulnerability : CVE-2026-113150

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag...

Linux Distros Unpatched Vulnerability : CVE-2026-113331

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113182

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-113303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...