An overview of the two PHP runtime vulnerabilities, their potential impact, affected versions, and available fixes

When Hang Up Does Not Hang Up In Signal, the hang-up button could fail even when a user tried to end a call. A critical bug in the RingRTC library let another call participant block the disconnect…

TL;DR Palo Alto Networks confirmed that the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, affect PAN-OS, Panorama and WildFire WF-500 appliances. The PAN-OS PHP2Shell risk sits in the mana…

TL;DR On October 23, 2026, the PHP team disclosed CVE-2026-115560, a new PHP session vulnerability tied to session upload progress. It can lead to remote code execution, but only in a rare setup. …

Inside CVE-2026–109618 and CVE-2026–109619, two PHP runtime flaws that could lead to Remote Code Execution

Remote Code Execution (RCE) vulnerabilities in core programming language runtimes are rare gems. When CVE-2026-109618 dropped, it…

The PHP Foundation recently published a security disclosure detailing a remote code execution risk. Specifically, maintainers registered the issue as CVE-2026-115560 across national vulnerability …

TL;DR Canada’s Cyber Centre updated its Fortinet advisory on October 23, 2026, to warn that CVE-2026-106173 “is being exploited in the wild.” This FortiSIEM vulnerability, rated …

TL;DR PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, lets unauthenticated attackers run code on servers that use PHP. PHP fixed both flaws on October 21, 2026, but PHP also ships insid…

TL;DR Full technical details and a working exploit are now public for CVE-2026-43501, a Linux kernel IPv6 vulnerability rated CVSS 9.8 by the kernel’s CVE team. The out-of-bounds write sits …

TL;DR Storybook has patched CVE-2026-114125, a CVSS 9.4 Storybook dev server vulnerability that lets a malicious website change files in a developer’s project. Under further conditions, the …

Between October 19 and 25, 2026, CVE Watchtower logged 4,222 new CVEs. This weekly CVE report tracks 12 exploited vulnerabilities from that period. Daily Cybersecurity’s intelligence sources…

TL;DR Microsoft has released an out-of-band .NET security update for .NET 8, 9 and 10, plus .NET 11 Release Candidate 3. It fixes CVE-2026-111497, a Brotli decompression buffer overflow, and CVE-2…

TL;DR The Apache Camel project disclosed eight Apache Camel vulnerabilities across components such as camel-saxon, camel-aws2-s3 and camel-keycloak. The most severe, CVE-2026-90885, is a high-seve…

TL;DR On October 23, 2026, the Ruby team shipped a Ruby security update in versions 4.0.9, 3.4.12 and 3.3.13. The releases fix memory bugs in Onigmo, Ruby’s regular expression engine. GitLab…

A Forgotten Backdoor on Millions of PCs An abandoned build of Popcorn Time kept a dangerous mechanism on millions of computers for years. Through it, anyone could quietly run code with top system …

A critical flaw within Google’s Brotli compression algorithm has sent shockwaves through the software industry. Specifically, the Brotli CVE-2026-111497 vulnerability permits unauthenticated…

TL;DR A full write-up and exploit are now public for CVE-2026-23074, a Linux kernel privilege escalation flaw in the teql traffic-control scheduler. The use-after-free dates back to Linux 2.6.12, …

Pada writeup kali ini saya akan membahas room CVEPHP2Shell di TryHackMe. Room ini membahas dua vulnerability kritis pada runtime PHP, yaitu…

PHP disclosed a second RCE path on October 23, two days after the emergency PHP2Shell fixes.