329546 matches found
Exploit for CVE-2026-109618
is-my-php-pwned 🔥 Did php2shell already own your servers? R...
CVE-2026-76466 Cisco Expressway Series Remote Code Execution Vulnerability
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. This vulnerability is due to the use of persistent cookies...
CVE-2026-76466
A vulnerability in the database service feature of Cisco Expressway Series (Expressway-C and Expressway-E devices) allows an unauthenticated, remote attacker to execute arbitrary operating system commands as root . The root cause involves the use of persistent cookies and insufficient validation ...
PHP2Shell: Why many websites had to go offline
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched. The...
php2shell-audit
php2shell-audit php2shell-audit is a non-destructive exposu...
Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products
Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp leaves request memory uninitialized due to improper control flow management,...
php2shell-poc
PHP2Shell: a reproducible PHP request-lifecycle RCE lab...
php: fatal error handling retains stale request state leading to use-after-free
A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...
USN-8948-2 php5, php7.0, php7.2, php7.4 vulnerabilities
USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handle...
USN-8948-2: PHP vulnerabilities
USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handle...
CVE-2026-113788 Lagoon core ssh service vulnerable to remote code execution
Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the ssh service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fa...
CVE-2026-113788
Lagoon, an application delivery platform for Kubernetes, contains a Remote Code Execution vulnerability in the ssh service of Lagoon core affecting versions prior to 2.33.1 . An attacker with a valid Lagoon user account can execute arbitrary code, potentially gaining elevated administrative permi...
CVE-2026-113788 Lagoon core ssh service vulnerable to remote code execution
Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the ssh service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fa...
Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these...
CVE-2026-109618
A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...
CVE-2026-109619
A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory OOM handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 sco...
Two critical RCEs in PHP core
Update 10/22: Added section detailing observations of in the wild exploitation and associated IoCs. Cisco Talos is tracking the disclosure of two unauthenticated remote code execution RCE flaws in PHP core, dubbed "php2shell", triggered by a plain HTTP request and exploitable before any applicati...