Most recent entries from all

4hzk000017 — ABB Manufacturing Execution System- PHP Vulnerabilities in DokuWiki installations

ABB is aware of publicly reported vulnerabilities in the product listed as affected in the advisory.

Updates to the affected component that fixed the vulnerabilities are available. An attacker who successfully exploited this vulnerability could remotely execute code on the server run-ning Dokuwiki. No active exploitations of the vulnerabilities have been reported by the time of writing this document

ALSA-2026:87070 — Important: php security update

Affected: AlmaLinux:10: php, AlmaLinux:10: php-bcmath, AlmaLinux:10: php-cli, AlmaLinux:10: php-common, AlmaLinux:10: php-dba, AlmaLinux:10: php-dbg, AlmaLinux:10: php-devel, AlmaLinux:10: php-embedded, AlmaLinux:10: php-enchant, AlmaLinux:10: php-ffi and 15 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2026-109618

Affected: Alpaquita:23: php81, Alpaquita:25: php83, Alpaquita:stream: php83

BIT-libphp-2026-109618 — RCE via OOM corruption

Affected: Bitnami: libphp

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

certfr-2026-ale-014 — [Mise à jour du 22 octobre 2026]
Le CERT-FR a connaissance de preuves d…

certfr-2026-ale-014

certfr-2026-avi-1359 — De multiples vulnérabilités ont été découvertes dans PHP. Elles permettent à un attaquant de provoquer une exécution de…

certfr-2026-avi-1359

CLEANSTART-2026-LE11033 — PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request

Affected: CleanStart: php

Security vulnerability affects the php package. PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.

fkie_cve-2026-109618

NCSC-2026-0443 — Kwetsbaarheden verholpen in PHP

NCSC-2026-0443

OESA-2026-4411 — php security update

Affected: openEuler:24.03-LTS-SP1: php

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server. Security Fix(es):

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).(CVE-2026-109619)

RHSA-2026:87070 — Red Hat Security Advisory: php security update

php: php: Denial of Service via unbounded recursion in SOAP parser php: OOM bailout during request parsing leads to memory corruption and RCE php: fatal error handling retains stale request state leading to use-after-free

RLSA-2026:87070 — Important: php security update

Affected: Rocky Linux:10: php

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)

* php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)

* php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SSA-566435 — SSA-566435: PHP2Shell Vulnerabilities in Siemens Software Products

On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.

UBUNTU-CVE-2026-109618

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:Pro:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:26.10: php8.5, Ubuntu:26.04:LTS: php8.5

out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

VA-26-295-01 — PHP insecure error handling and state management

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, the code before the allocation does not properly account for a early exit and leaves reachable request memory in an uninitialized or otherwise invalid state. The request shutdown procedure may then read or branch on the uninitialized memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Application-independent, complete remote code execution has been validated over HTTP against mod_php with default PHP input and memory limits and normal prefork workers. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP contains error handling, Session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, Session and error handling operations run before normal initialization of the next request. They can trust stale state left by the previous request before initialization has a chance to replace it, causing a use after free. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

WID-SEC-W-2026-4055 — PHP: Mehrere Schwachstellen ermöglichen Codeausführung

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um Speicherinhalte offenzulegen, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.