Vulnerabilities & fixes · Archive

Vulnerabilities & fixes

Dates are publishers’ publication dates, source update dates, or CISA catalog-added dates. First collected records when SecSIG first saw the entry.

• New Serious PHP Vulnerabilities Released and Patched ↗ (opens in a new tab)

  Schneier on Security · Published 2026-10-22 · First collected 2026-10-24

• PHP2Shell: Critical RCE Vulnerabilities Affect a Large Majority of Web Servers ↗ (opens in a new tab)

  LevelBlue (SpiderLabs Blog) · Published 2026-10-22 · First collected 2026-10-24

• Patching PHP2Shell: How to Find and Fix Your Exposure ↗ (opens in a new tab)

  Outpost24 · Published 2026-10-22 · First collected 2026-10-24

• PHP2Shell: What the Vulnerability Means and Why Patching Is Urgent ↗ (opens in a new tab)

  G DATA Security Blog · Published 2026-10-22 · First collected 2026-10-24

• PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure ↗ (opens in a new tab)

  Infosecurity Magazine · Published 2026-10-22 · First collected 2026-10-24

• PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution ↗ (opens in a new tab)

  Broadcom – Symantec Blogs · Published 2026-10-22 · First collected 2026-10-24

• How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia ↗ (opens in a new tab)

  Kaspersky Securelist · Published 2026-10-22 · First collected 2026-10-24

• PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now ↗ (opens in a new tab)

  Blog RSS Feed | Snyk · Published 2026-10-22 · First collected 2026-10-24

• Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched ↗ (opens in a new tab)

  WIRED Security · Published 2026-10-22 · First collected 2026-10-24

• Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) ↗ (opens in a new tab)

  AWS Security Blog · Published 2026-10-22 · First collected 2026-10-24

• SVD-2026-1013: Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026 ↗ (opens in a new tab)

  Splunk Security Announcements · Published 2026-10-22 · First collected 2026-10-24

• 25 Vulnerabilities in the x402 Protocol: Inside Three Critical Findings ↗ (opens in a new tab)

  V12 · Published 2026-10-22 · First collected 2026-10-24

• October 2026 PHP vulnerabilities: Sandfly is not affected ↗ (opens in a new tab)

  Sandfly Security Blog RSS Feed · Published 2026-10-21 · First collected 2026-10-24

• CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks ↗ (opens in a new tab)

  Zscaler Research Blogs · Published 2026-10-21 · First collected 2026-10-24

• Micropatches released for Windows Active Directory Domain Services Remote Code Execution Vulnerability (CVE-2026-49179) ↗ (opens in a new tab)

  0patch Blog · Published 2026-10-21 · First collected 2026-10-24

• TiDB Breach Exposes Flawed Cloud Security Assumptions ↗ (opens in a new tab)

  darkreading · Published 2026-10-21 · First collected 2026-10-24

• Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619) ↗ (opens in a new tab)

  Sucuri Blog · Published 2026-10-21 · First collected 2026-10-24

• CivicPlus takes municipal websites offline over PHP security flaw ↗ (opens in a new tab)

  DysruptionHub · Published 2026-10-21 · First collected 2026-10-24

• PHP2Shell: How to Protect Vulnerable PHP Workloads While Patching ↗ (opens in a new tab)

  Aqua · Published 2026-10-21 · First collected 2026-10-24

• EU Website Outages Follow Critical PHP Flaws: What IT Teams Should Know ↗ (opens in a new tab)

  Security Archives - TechRepublic · Published 2026-10-21 · First collected 2026-10-24

• PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches ↗ (opens in a new tab)

  Socket · Published 2026-10-21 · First collected 2026-10-24

• The Missing Layer in Vulnerability Prioritization: Full Visibility Into Your Attack Surface ↗ (opens in a new tab)

  Threat Intelligence Blog | Flashpoint · Published 2026-10-21 · First collected 2026-10-24

• Multiple Vulnerabilities in PHP Could Allow for Remote Code Execution ↗ (opens in a new tab)

  Cyber Security Advisories - MS-ISAC · Published 2026-10-21 · First collected 2026-10-24

• Account sharing prevention guide for subscription businesses ↗ (opens in a new tab)

  Fingerprint Blog RSS Feed · Published 2026-10-21 · First collected 2026-10-24

• PHP2Shell Makes PHP Inventory and Patch Ownership Urgent ↗ (opens in a new tab)

  Sonatype Blog · Published 2026-10-21 · First collected 2026-10-24

• Widespread PHP Flaw May Cause Many Site Outages Today ↗ (opens in a new tab)

  Krebs on Security · Published 2026-10-21 · First collected 2026-10-24

• Analysis of the GitHub “php2shell” Repository: Public PoCs and Defense Tools That Spread Immediately After the Disclosure of the PHP Vulnerability ↗ (opens in a new tab)

  ASEC · Published 2026-10-21 · First collected 2026-10-24

• Critical PHP “PHP2Shell” RCE Vulnerabilities Allow Unauthenticated Remote Code Execution (CVSS 9.2) ↗ (opens in a new tab)

  Orca Security Blog · Published 2026-10-21 · First collected 2026-10-24

• What to do as critical PHP flaws puts millions of websites at risk ↗ (opens in a new tab)

  ComputerWeekly.com · Published 2026-10-21 · First collected 2026-10-24

• Cloudflare deploys protections against php2shell vulnerability ↗ (opens in a new tab)

  Cloudflare – Security Tag · Published 2026-10-21 · First collected 2026-10-24