LinkThe PHP teamAnnouncement
Teams hosting PHP applications on Windows systems that fetch remote content via cURL should update to prevent potential memory corruption from malicious compressed responses.
Because higher-level HTTP clients frequently enable automatic response decompression behind the scenes, this vulnerability can expose applications even if the default cURL setting is off. Packaging dependency updates via build suffixes allows administrators to secure installations without breaking runtime compatibility.
Summary generated by AI (Gemini 3.8 Flash, 27 October 2026). It may contain errors – the original source is authoritative.
Similar in content, found by the AI search.
Link:Calif Research
Calif Research has disclosed PHP2Shell, detailing two severe PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) triggered via out-of-memory states and addressed in the October 2026 security release.
Link:watchTowr
Dubbed PHP2Shell, two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) in PHP allow unauthenticated attackers to execute arbitrary code. Security firm watchTowr confirmed in-the-wild exploitation.
Article:Wiz Research
Wiz Research has disclosed PHP2Shell, a set of critical memory-safety vulnerabilities in the core PHP engine affecting versions dating back to PHP 5.4. Tracked under CVE-2026-109618 and CVE-2026-109619 with CVSS scores up to 9.2, they enable unauthenticated remote code execution and process-memory leakage. Researchers utilised frontier AI models to rapidly build and adapt complex exploit chains across targets.
Article:Daniele Molteni, Dan Jones, and Kuber Nandwani
Cloudflare has rolled out Managed WAF rules to protect against the php2shell vulnerabilities affecting PHP 5.4 and later. The mitigations introduce full transaction detection to block exploits before responses reach requesters.
VideoVideo:CURT
Two critical vulnerabilities in the PHP core engine, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), allow unauthenticated Remote Code Execution before application code even begins to execute.
Link:The PostgreSQL Global Development Group
The PostgreSQL Global Development Group has issued updates across all supported branches, alongside PostgreSQL 19 Beta 3. The releases resolve 28 security vulnerabilities, while PostgreSQL 14 is scheduled to reach its end of life in November 2026.
Parts of this content were created with the assistance of AI.
