php2shell: Critical flaws allow code injection in PHP

Two flaws expose PHP web servers to remote attacks. Versions from the past 20 years are affected; admins should patch.

PHP vulnerability 2026 explained: What happened with 'PHP2Shell', how it affects millions of sites, patches and what precautions you must take

Two critical remote code execution (RCE) flaws dubbed "PHP2Shell" have hit the core PHP programming language, triggering ...
Security Boulevard

php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches.Key takeawaysCVE-2026-109618 and ...
Techaeris

PHP2Shell: The Emergency PHP Patch Is Out, and the Real Race Starts Now

PHP2Shell, the two critical PHP remote code execution flaws leaked a day early, now has an emergency patch. Here is what ...
dexpose.io

PHP2Shell: How Security Teams Should Assess and Contain the Reported PHP RCEs

The configured form-field name is normally PHP_SESSION_UPLOAD_PROGRESS. When the relevant multipart request conditions are met, the parser may invoke PHP’s upload-progress handling. The PHP manual ...
InfoQ

Microsoft Previews dotnetup: Toolchain Manager for .NET SDKs and Runtimes

Microsoft has released a public preview of dotnetup, a cross-platform toolchain manager that installs and updates .NET SDKs ...
The Hacker News

Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections

Attackers hijacked over 300 Tor exit relays to intercept SSH connections and steal passwords from users who accepted changed ...