https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:53:56.399540+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2024:10949 ALSA-2024:10949 — Moderate: php:8.2 security update 2026-10-02T19:53:56.705575+00:00

Affected: AlmaLinux:9: apcu-panel, AlmaLinux:9: php, AlmaLinux:9: php-bcmath, AlmaLinux:9: php-cli, AlmaLinux:9: php-common, AlmaLinux:9: php-dba, AlmaLinux:9: php-dbg, AlmaLinux:9: php-devel, AlmaLinux:9: php-embedded, AlmaLinux:9: php-enchant and 21 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756) * php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096) * php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458) * php: Erroneous parsing of multipart form data (CVE-2024-8925) * php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927) * php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-03785 bdu:2024-03785 2026-10-02T19:53:56.705695+00:00 bdu:2024-03785 https://cve.radiocsirt.org/vuln/bell-cve-2024-2756 BELL-CVE-2024-2756 2026-10-02T19:53:56.705714+00:00

Affected: Alpaquita:23: php81, Alpaquita:stream: php83

 https://cve.radiocsirt.org/vuln/bit-libphp-2024-2756 BIT-libphp-2024-2756 — __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix 2026-10-02T19:53:56.705734+00:00

Affected: Bitnami: libphp

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0300 certfr-2024-avi-0300 — De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoque… 2026-10-02T19:53:56.705757+00:00 certfr-2024-avi-0300 https://cve.radiocsirt.org/vuln/euvd-2026-259033 EUVD-2026-259033 2026-10-02T19:53:56.705773+00:00 EUVD-2026-259033 https://cve.radiocsirt.org/vuln/fkie_cve-2024-2756 fkie_cve-2024-2756 2026-10-02T19:53:56.705783+00:00

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

 https://cve.radiocsirt.org/vuln/gsd-2024-2756 gsd-2024-2756 2026-10-02T19:53:56.705805+00:00 gsd-2024-2756 https://cve.radiocsirt.org/vuln/msrc_cve-2024-2756 msrc_CVE-2024-2756 — __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix 2026-10-02T19:53:56.705816+00:00 msrc_CVE-2024-2756 https://cve.radiocsirt.org/vuln/oesa-2024-2061 OESA-2024-2061 — php security update 2026-10-02T19:53:56.705831+00:00

Affected: openEuler:22.03-LTS-SP3: php

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server. Security Fix(es): Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.  (CVE-2024-2756)

 https://cve.radiocsirt.org/vuln/rhsa-2024:10949 RHSA-2024:10949 — Red Hat Security Advisory: php:8.2 security update 2026-10-02T19:53:56.705856+00:00

php: host/secure cookie bypass due to partial CVE-2022-31629 fix php: password_verify can erroneously return true, opening ATO risk php: Filter bypass in filter_var (FILTER_VALIDATE_URL) php: Erroneous parsing of multipart form data php: cgi.force_redirect configuration is bypassable due to the environment variable collision php: PHP-FPM Log Manipulation Vulnerability

 https://cve.radiocsirt.org/vuln/suse-su-2024:1444-1 SUSE-SU-2024:1444-1 — Security update for php7 2026-10-02T19:53:56.705884+00:00

Security update for php7

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-2756 UBUNTU-CVE-2024-2756 2026-10-02T19:53:56.705900+00:00

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0867 WID-SEC-W-2024-0867 — PHP: Mehrere Schwachstellen 2026-10-02T19:53:56.705927+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.