Security Bulletin: IBM TS4300 3U Tape Library is vulnerable to remote code execution (CVE-2026-109618, CVE-2026-109619)

Summary IBM TS4300 3U Tape Library is vulnerable to remote code execution. Vulnerability Details CVEID:CVE-2026-109618 DESCRIPTION: PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

Cloudflare PHP CTF — php2shell WAF-bypass research Target:...

SUSE-SU-2026:3509-1 Security update for php8

This update for php8 fixes the following issues: Update to version 8.3.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. - CVE-2026-9672: security issues in libgd bsc1273078. -...

CVE-2026-121925

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...

EUVD-2026-116886

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...

CVE-2026-121925 Buffer overflow in SAML authentication post-back URL handling in libsnowflakeclient and Snowflake PHP PDO Driver

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...

CVE-2026-121925

A stack-based buffer overflow exists in libsnowflakeclient and the Snowflake PHP PDO Driver during SAML-based authentication. The vulnerability occurs because the drivers may copy a value from an identity provider's HTML response into a fixed-size memory buffer without validating its length. This...

CVE-2026-121925 Buffer overflow in SAML authentication post-back URL handling in libsnowflakeclient and Snowflake PHP PDO Driver

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...

PHP2Shell on Windows and macOS: Automating the PHP Upgrade, With or Without an Agent

Executive Summary PHP2Shell CVE-2026-109618 and CVE-2026-109619 allows unauthenticated remote code execution on exposed PHP servers. PHP has released fixed versions. On Linux, distribution packages carry the fix. On Windows and macOS, they don’t: Microsoft and Apple don’t ship PHP, so the fix is ...

WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by hhhai in WordPress Plugin Radius Booking — Booking Calendar for Appointments & Services versions = 1.0.20...

CVE-2026-115243

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking...

CVE-2026-115243 WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking...

CVE-2026-112244

The Duplicator and duplicator-pro WordPress plugins, in versions before 5.1.0 , are vulnerable to an unauthenticated full path disclosure . This issue occurs because the plugins do not prevent direct access to certain bundled PHP files. When these files are accessed outside of their expected cont...

poc

PHP2Shell — Detection & Mitigation Guide PHP session.upload...

PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 - Use-After-Free Remote Code Execution

PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12 contain a use-after-free caused by request-owned global state that is not reset before the request heap is freed, letting unauthenticated attackers execute arbitrary code in a subsequent request handled by the same...

Invision Community <=5.0.6 Unauthenticated RCE via Template Injection

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller /applications/core/modules/front/system/themeeditor.php, where a protected method named customCss can be invoked by unauthenticated...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell — Exploitable Lab CVE-2026-109618 · CVE-2026-1096...

PT-2026-137289

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. A maliciously crafted import file can cause untrusted data to be deserialized PHP Object Injection, CWE-502, potentially leading to remote code execution...

CVE-2026-121925: Snowflake: A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions,…

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...

PT-2026-136928

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmp profile settings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key...