113811 matches found
PT-2026-122495
Name of the Vulnerable Software and Affected Versions Prime Mover versions prior to 2.2.2 Description An unauthenticated attacker can perform PHP Object Injection by submitting a crafted, base64-encoded serialized object through the standard comment-submission endpoint 'wp-comments-post.php', whi...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143722)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143722 advisory. PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125...
PHP Session Upload Progress Mitigation
A Bash utility that audits common PHP configuration layouts and can disable session upload progress as a temporary mitigation for an unlikely remote code execution vector...
PHP 8.5.11 PHP2Shell Scanner
PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain memory-handling flaws that can allow unauthenticated remote code execution. This tool sends multipart request probes and identifies susceptible targets from crash signals or the X-Powered-By version...
PHP 8.5.11 PHP2Shell Guard
php2shell-guard audits PHP installations and applies package updates and interim configuration mitigations for PHP2Shell vulnerabilities...
MiracleLinux 9 : php-8.0.30-8.el9_8.1 (AXSA:2026-2143:05)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2143:05 advisory. php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption...
PHP 7.3.13 Security Backport Patches
Unofficial backport patches for PHP versions 5.4.33, 5.6.7, 7.1.1, and 7.3.13 mitigate CVE-2026-109618 out-of-memory corruption and CVE-2026-109619 stale global state vulnerabilities...
PHP Session Upload Progress Remote Code Execution
PHP session upload progress can permit attacker-controlled object deserialization when an application uses phpbinary or phpserialize and switches to the php serializer before sessionstart. Included proof of concept demonstrates the serializer-switch condition and a session-file LFI lab...
php2shell-defender-toolkit
PHP2Shell defender toolkit Hunt queries, logging and audit sc...
-php2shell-advanced
PHP2Shell Advanced Exploit Framework An advanced exploit fram...
php2shell-check
PHP2Shell Check A passive, self-hosted PHP vulnerability...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
PHP2Shell Labs Is your server exposed to PHP2Shell? PHP2Shel...
Exploit for CVE-2026-115560
cve-115560-kit — local lab for the PHP session serialize-handl...
[R1] Stand-alone Security Patch Available for Tenable Enclave Security Versions 1.7.0, 1.8.0, 1.9.1: SC-202610.2
R1 Stand-alone Security Patch Available for Tenable Enclave Security Versions 1.7.0, 1.8.0, 1.9.1: SC-202610.2 Arnie Cabral Fri, 10/23/2026 - 16:14 Tenable Enclave Security leverages third-party software to help provide underlying functionality. One of the third-party components php was found to...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
Php2Shell-Lab Educational Docker lab for CVE-2026-109618...
[R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2, 6.8.0, 6.9.1: SC-202610.2
R1 Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2, 6.8.0, 6.9.1: SC-202610.2 Arnie Cabral Fri, 10/23/2026 - 15:52 Security Center leverages third-party software to help provide underlying functionality. One of the third-party components php was found to...
php: fatal error handling retains stale request state leading to use-after-free
A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...
Important: Red Hat Security Advisory: php:8.2 security update
An update for the php:8.2 module is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
php: OOM bailout during request parsing leads to memory corruption and RCE
A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...