Part-DB arbitrary file upload vulnerability

Versions prior to Part-DB 2.12.1 contain an arbitrary file upload vulnerability. This vulnerability arises because the attachment upload handler stores uploaded files using client-supplied file extensions; however, the extension blacklist does not include “phar”. As a result, uploaded .phar files...

PT-2026-121887

Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description An issue exists that could potentially allow remote code execution on the server. This occurs under a rare combination of non-default session settings and specific application behavior. Amazon...

PHP 8.5.11 Multipart OOM Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain out-of-memory and stale request-state flaws that can lead to remote code execution. The supplied proof of concept demonstrates multipart upload-progress trigger paths. https://packetstorm.news/download/237257...

Linux Distros Unpatched Vulnerability : CVE-2026-113356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without...

PHP 7.0.33 PHP2Shell Patch

PHP version 7.0.33 for CentOS 7 contains remote code execution issues involving out-of-memory state corruption and stale global state. This provides patches and a script to build a remedial Remi source RPM...

PHP 8.5.11 PHP2Shell Exposure Scanner

PHP versions through 8.5.11 contain the PHP2Shell vulnerabilities. This tool performs read-only HTTP exposure scans and on-host version and package-changelog checks...

PHP 8.5.11 Remote Code Execution

PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain remote code execution vulnerabilities. This script performs behavioral checks for affected request parsing and session state handling...

PHP 8.3.36 CentOS 7 Security Update

PHP version 7.4.33 and version 8.3.36 CentOS 7 packages include fixes for two remote code execution vulnerabilities...

PHP 8.5.11 PHP2Shell Patch Check

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain memory safety flaws that can allow remote code execution. The supplied Bash tool checks local CLI, FPM, and Apache PHP component versions against upstream fixed releases...

RHEL 9 : php (RHSA-2026:88725)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88725 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

PT-2026-135139

Security vulnerability affects the php package. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request...

Important: php:7.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading to use-after-free CVE-2026-109619 For more...

ROS-20261023-73-0255

The vulnerability in PHP is related to improper management of sequential memory allocation. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261023-73-0203

The vulnerability in PHP is related to improper management of sequential memory allocation. Exploiting this vulnerability can allow an attacker to cause a service failure...

RHEL 8 : php:7.4 (RHSA-2026:88532)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88532 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

ROS-20261023-73-0257

The vulnerability in PHP is related to improper management of sequential memory allocation. Exploiting this vulnerability can allow an attacker to cause a service failure...

Rocky Linux 8.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1668)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261668 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

RHEL 9 : php (RHSA-2026:88720)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88720 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

HPESBGN05174 rev.2 - Certain HPE Products Impacted by Multiple PHP Vulnerabilities (PHP2Shell)

Potential Security Impact: Remote: Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba ClearPass Policy Manager 6.11.0, 6.11.4, 6.12.0, 6.11.5, 6.11.6, 6.11.7, 6.12.1, 6.11.8, 6.12.2, 6.11.9, 6.12.3, 6.11.10, 6.12.4, 6.11.11, 6.12.5, 6.11.12, 6.12.6, 6.11.13,...

No version of Vaadin uses PHP

No version of Vaadin uses PHP. No Vaadin product contains PHP code, and no PHP interpreter takes part in building, running or deploying a Vaadin application. Vaadin is therefore not affected by CVE-2026-109618 or CVE-2026-109619, and no Vaadin release is needed in response to them.This page exist...