Critical PHP flaws dubbed PHP2Shell allow unauthenticated code execution
Early exploit attempts followed disclosure, and some sites went offline while owners applied patches.
86
- Mentions · 7d2
- Mentions · 30d20
- All mentions36
- First seenAug 26, 2026
- Last mentioned4d ago
Timeline
36 articles · newest firstPHP2Shell flaws allow unauthenticated RCE; wild attacks reported
Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; both flaws score CVSS 9.2.
86
Attackers exploit Citrix NetScaler RCE CVE-2026-88771
Unauthenticated attackers poison logs, plant web shells and try to run a FreeBSD implant; CISA listed the flaw.
88
GitLab RCE flaw scores CVSS 10 (CVE-2026-110264)
Community and Enterprise builds from 7.0 before the listed 18.x and 19.x patches need urgent updates.
78
PHP emergency patches fix two critical unauthenticated RCE flaws
Both CVSS 9.2 bugs affect web-facing PHP, including PHP-FPM and mod_php; fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
84
PHP2Shell flaws draw early attacks; emergency PHP updates out
Fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; both bugs are rated 9.2.
92
PHP releases emergency fixes for two critical unauthenticated RCEs
Exploits are public, and Finnish and Dutch sites went offline while watchTowr says attempts have not succeeded.
86
PHP patches critical unauthenticated RCE flaws called PHP2Shell
PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 fix two web-worker RCE bugs; in-the-wild attacks are not established.
78
PHP rushes emergency patches as early php2shell attacks reported
Cloudflare says early attacks are emerging and has pushed temporary firewall rules to all customers, including free accounts.
90
PHP rates two PHP2Shell flaws 9.2; fix due October 21
No attacks are reported, PHP offered no workaround, and disabling upload progress is not a full fix.
76
Critical PHP RCE flaws leaked a day before scheduled patches
CERT-EU told operators to prepare to patch or isolate internet-facing PHP apps; the PHP team rates the flaws CVSS 9.2, not 10.
78
Emergency PHP patches due for two critical RCE flaws as attacks emerge
Cloudflare reports early attacks; expected fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with older branches unfixed.
88
Critical PHP remote code execution flaw already under attack
Patchstack says the only current fix is upgrading PHP, with an update scheduled for October 21 at 14:00 UTC.
90
Leaked PHP2Shell flaws may allow unauthenticated remote code execution
CVE-2026-109618 and CVE-2026-109619 both score 9.2; WatchTowr and Huntress report no exploitation yet.
80
PHP to ship emergency fixes for two critical RCE flaws rated 9.2
Only branches 8.2 through 8.5 can be patched; affected versions and exploit details remain unconfirmed.
82
PHP warns of two critical flaws, patches due October 21
Each flaw is rated CVSS v4.0 9.2; PHP has not confirmed CVE IDs, versions, or remote code execution.
76
PHP flaws CVE-2026-109618 and CVE-2026-109619 may allow unauthenticated RCE
CERT-EU says details are unpublished, every PHP release since PHP 5 may be affected, and the fix is set for 21 October at 14:00 UTC.
76
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
Attackers are actively exploiting critical unauthenticated NetScaler RCE CVE-2026-88771, now listed in CISA's KEV catalog.
86
2026-017: Critical Vulnerability in Cisco Secure Email Gateway
Actively exploited CVE-2026-76519 lets unauthenticated attackers gain root on Cisco Secure Email Gateway.
86
2026-016: Critical Vulnerability in GitLab CE and EE
GitLab patches critical CVE-2026-97229 (CVSS 10.0) allowing unauthenticated RCE via CI/CD regex compiler, plus 23 other security issues in CE/EE versions.
78
NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)
Citrix NetScaler zero-day CVE-2026-88771 is under mass exploitation after a public proof of concept.
93
2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
CERT-EU warns two critical Citrix NetScaler RCE flaws are exploited in the wild and urges immediate patching.
88
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers
F5 patches actively exploited critical zero-day (CVE-2026-94127) in BIG-IP APM OAuth servers, enabling unauthenticated remote code execution.
95
2026-013: Critical Vulnerability in F5 BIG-IP APM
CERT-EU says exploited F5 BIG-IP APM flaw CVE-2026-94127 allows unauthenticated remote code execution.
86
2026-012: Critical Vulnerabilities in Check Point Products
Check Point issued emergency hotfixes for two CVSS 9.8 flaws (CVE-2026-85102, CVE-2026-85103) enabling unauthenticated RCE on VPN-enabled gateways.
80
2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server
SAP patched two critical flaws, OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240), allowing unauthenticated attackers to execute OS commands on SAP hosts.
75
2026-007: Critical Vulnerability in Windows Netlogon
Actively exploited CVSS 9.8 Windows Netlogon flaw lets unauthenticated attackers execute code with SYSTEM privileges on domain controllers.
88
2026-008: Critical vulnerabilities in Ivanti Sentry
Ivanti patched Sentry: pre-auth OS command injection CVE-2026-10520 (CVSS 10) enables unauthenticated root RCE, and auth bypass CVE-2026-10523 (CVSS 9.9).
70
Risky Bulletin: Russia starts blocking DoH and DoT
Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.
40
2026-010: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
Citrix patched NetScaler ADC/Gateway: auth bypass CVE-2026-19490 (CVSS 9.3) on Gateway/AAA configs and memory overflow CVE-2026-19489 (CVSS 8.8) requiring SIP ALG.
66
2026-009: Critical Vulnerabilities in Microsoft SharePoint
WatchTowr observed active exploitation of SharePoint RCE CVE-2026-50522 (CVSS 9.8), part of an ongoing wave of exploited on-prem SharePoint flaws patched by Microsoft.
90
2026-006: Critical Vulnerability in PAN-OS
Palo Alto Networks PAN-OS User-ID Authentication Portal flaw allows unauthenticated root RCE; limited exploitation observed and patches still pending.
66
2026-004: Critical Vulnerability in SharePoint Exploited
CVE-2026-20963 (CVSS 9.8), an unauthenticated RCE in on-prem SharePoint, was added to CISA's KEV on 18 March 2026 and is actively exploited.
90
2026-003: Multiple Vulnerabilities in Citrix NetScaler and Citrix ADC
Citrix NetScaler ADC and Gateway flaws enable memory information disclosure and user session mix-up; no active exploitation is observed yet.
55
2026-002: Multiple Vulnerabilities in Cisco Products
Cisco fixed SD-WAN Controller auth bypass CVE-2026-20127 (CVSS 10) exploited in the wild since 2023, plus several critical and high flaws in SD-WAN Manager.
78
2026-001: Critical vulnerabilities in Ivanti EPMM
Ivanti EPMM has two critical CVSS 9.8 flaws allowing unauthenticated remote code execution; limited exploitation has already been observed.
72
Related CVEs
by mentions- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2026-8877278%9.5Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
- CVE-2026-9412725%9.3Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile
- CVE-2026-505223%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server
- CVE-2026-561641%9.8Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation
- CVE-2026-1949033%9.3Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-1074062%9.5Memory overflow RCE/DoS in NetScaler ADC and Gateway
- CVE-2026-19489<1%8.8Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway
Appears with
- watchTowrorganization · 10
- PHPvendor · 8
- PHPproduct · 7
- CISAorganization · 7
- Citrixvendor · 6
- NetScaler Gatewayproduct · 5
- NetScaler ADCproduct · 5
- CERT-EUvendor · 5
- WordPressproduct · 4
- Cloudflareorganization · 4
- Joomlaproduct · 4
- Magentoproduct · 4
- Drupalproduct · 4
- Huntressorganization · 3
- Microsoftvendor · 3
- SharePoint Enterprise Server 2016product · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.