Warnings had surfaced years earlier, but the discovery of serious attack methods triggered a chaotic race to release security fixes.

Prefer the deep-dive…

One request. No login. A decade-old flaw in the PHP engine, finally weaponized.

TL;DR On October 23, 2026, the PHP team disclosed CVE-2026-115560, a new PHP session vulnerability tied to session upload progress. It can lead to remote code execution, but only in a rare setup. …

PHP2Shell: Web’in %69'unu Etkileyen Kritik PHP Açıkları (CVE-2026–109618 & 109619) Evet arkadaşlar yaklaşık 2 gün önce karşımıza PHP2Shell adında çok geniş kapsamlı ve çok …

PHP2Shell: CVE-2026–109618 and CVE-2026–109619

Hello, welcome to a fool’s guide to cybersecurity today, we’re talking about two critical flaws within PHP. Two critical vulnerabilities…

How I read the vulnerable PHP source, triggered the OOM condition by hand, found the one-line patch and learned why the runtime is the…

PHP released fixes for CVE-2026–109618 (memory corruption when PHP runs out of memory) and CVE-2026–109619 (use-after-free in request…

Understanding CVE-2026–109618 and CVE-2026–109619, available security patches, and an open-source assessment tool developed by Grupo Oruss.