New Serious PHP Vulnerabilities Released and Patched

PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

Summary from Schneier on Security.

More in AppSec

LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release

The Hacker News6h agoThreat IntelAppSecNetwork

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

The Hacker News7h agoAppSecVulnerabilities

China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

The Hacker News10h agoThreat IntelAppSecAI

SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More

Podcast13 minSANS Internet Storm Center StormCast13h agoAppSecNetworkVulnerabilitiesCVE-2026-109618CVE-2026-109619

The race to the first exploit // php2shell

VideoLiveOverflow14h agoAppSecVulnerabilitiesCVE-2026-109618CVE-2026-109619