php2shell-poc

php2shell CVE-2026-109618 · CVE-2026-109619 Independent...

PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now

The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The PHP project says all PHP users are strongly encouraged to update immediately. We recommend making...

SUSE CVE-2026-109618

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

SUSE CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...

SUSE CVE-2026-112992

Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-112993

Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-112994

UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-112995

Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-112996

Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-112997

Information leak in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-112998

Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-112999

Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-113000

Information leak in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-113001

Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-113003

Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-113004

Type confusion in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted file. Chromium security severity: Low...

SUSE CVE-2026-113005

Missing authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-113006

Incorrect authorization in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-113007

Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-113008

Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...