Vulnerabilities & fixes · Archive

Vulnerabilities & fixes

Dates are publishers’ publication dates, source update dates, or CISA catalog-added dates. First collected records when SecSIG first saw the entry.

• PHP2Shell: Analysis of PHP Core RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 ↗ (opens in a new tab)

  CIP Blog · Published 2026-10-22 · First collected 2026-10-24

• Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot ↗ (opens in a new tab)

  AWS Security Blog · Published 2026-10-21 · First collected 2026-10-24

• Critical PHP vulnerabilities send organizations scrambling to secure their systems ↗ (opens in a new tab)

  Security - SiliconANGLE · Published 2026-10-21 · First collected 2026-10-24

• PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline ↗ (opens in a new tab)

  Socket · Published 2026-10-21 · First collected 2026-10-24

• Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) ↗ (opens in a new tab)

  Kaspersky Securelist · Published 2026-10-21 · First collected 2026-10-24

• PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched ↗ (opens in a new tab)

  www.theregister.com - Articles · Published 2026-10-21 · First collected 2026-10-24

• Reproducing the PHP2Shell Vulnerability and Detection Using AhnLab EDR/XDR ↗ (opens in a new tab)

  ASEC · Published 2026-10-21 · First collected 2026-10-24

• ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire ↗ (opens in a new tab)

  WIRED Security · Published 2026-10-21 · First collected 2026-10-24

• Fixes issued for critical PHP vulnerabilities ↗ (opens in a new tab)

  Latest from ITPro in Security · Published 2026-10-21 · First collected 2026-10-24

• Critical PHP vulnerabilities expose most websites to potential compromise ↗ (opens in a new tab)

  Cybersecurity Dive - Latest News · Published 2026-10-21 · First collected 2026-10-24

• Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches ↗ (opens in a new tab)

  Infosecurity Magazine · Published 2026-10-21 · First collected 2026-10-24

• Ernstige kwetsbaarheden in PHP: bereid je voor op patchen ↗ (opens in a new tab)

  NCSC NL news · Published 2026-10-21 · First collected 2026-10-24

• Critical flaws strike PHP as disclosure embargo is broken ↗ (opens in a new tab)

  iTnews · Published 2026-10-21 · First collected 2026-10-24

• UPDATE ALERTĂ: Vulnerabilități critice în PHP ↗ (opens in a new tab)

  CERT.RO news · Published 2026-10-21 · First collected 2026-10-24

• PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619) ↗ (opens in a new tab)

  FortiGuard Labs | FortiGuard Center - IR Advisories · Published 2026-10-21 · First collected 2026-10-24

• PHP warns it plans to release 2 emergency patches imminently ↗ (opens in a new tab)

  Security - Ars Technica · Published 2026-10-21 · First collected 2026-10-24

• It Happened Again: Colorado's Water Breaches Exploit the Path That Should Never Have Existed ↗ (opens in a new tab)

  OPSWAT Blog · Published 2026-10-21 · First collected 2026-10-24

• SVD-2026-1010: Security Vulnerabilities in Splunk SOAR - October 2026 ↗ (opens in a new tab)

  Splunk Security Announcements · Published 2026-10-21 · First collected 2026-10-24

• GLSA 202610-01: ca-certificates: Compromised Intermediate Certificate Authority ↗ (opens in a new tab)

  Gentoo security · Published 2026-10-21 · First collected 2026-10-24

• Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) ↗ (opens in a new tab)

  Unit 42 · Published 2026-10-20 · First collected 2026-10-24

• [0day-rubbish] Royal Render 9.1.26b: default-unauthenticated job submission on rrServer TCP 7773 reaches worker-side shell execution as the worker identity, measured root (8.1 High) ↗ (opens in a new tab)

  Full Disclosure · Published 2026-10-20 · First collected 2026-10-24

• VU#645818: Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting ↗ (opens in a new tab)

  CERT/CC Vulnerability Notes · Published 2026-10-20 · First collected 2026-10-24

• Oracle October 2026 Critical Patch Update Addresses 1209 CVEs ↗ (opens in a new tab)

  Tenable Cyber Exposure Alerts · Published 2026-10-20 · First collected 2026-10-24

• A Vulnerability in BeyondTrust Remote Support Could Allow for Arbitrary Upload of Files ↗ (opens in a new tab)

  Cyber Security Advisories - MS-ISAC · Published 2026-10-20 · First collected 2026-10-24

• Cyber Risk Management Strategies for Enterprises ↗ (opens in a new tab)

  IOActive · Published 2026-10-20 · First collected 2026-10-24

• Possible new Cellebrite iPhone Radio Zero-Day ↗ (opens in a new tab)

  Schneier on Security · Published 2026-10-20 · First collected 2026-10-24

• How to prevent fake signups on your platform ↗ (opens in a new tab)

  Fingerprint Blog RSS Feed · Published 2026-10-19 · First collected 2026-10-24

• The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience ↗ (opens in a new tab)

  darkreading · Published 2026-10-19 · First collected 2026-10-24

• Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities ↗ (opens in a new tab)

  Cloudflare – Security Tag · Published 2026-10-19 · First collected 2026-10-24

• Microsoft Edge Is Testing Restart-Free Security Updates: What Works Now ↗ (opens in a new tab)

  Security Archives - TechRepublic · Published 2026-10-19 · First collected 2026-10-24