Apache mod_php

Mentions · 7d3
Mentions · 30d3
All mentions3
First seenOct 21, 2026
Last mentioned3d ago

Timeline

3 articles · newest first

PHP patches two critical unauthenticated RCE flaws

Fixes ship in 8.5.12, 8.4.27, 8.3.36 and 8.2.35; config changes do not fully close exposure.

GBHackersupdated Oct 22, 22:24 UTC · 2d agofirst Oct 22, 05:15 UTC · 3d agoVulnerability 7 sourcesCVE-2026-109618 CVE-2026-1096191 · 1 read

PHP patches two critical unauthenticated RCE flaws

Both score CVSS 9.2; researchers built RCE exploits, and a public exploit is expected soon.

Rapid7 Blogupdated Oct 21, 23:02 UTC · 3d agofirst Oct 21, 15:22 UTC · 4d agoVulnerability 30 sourcesCVE-2026-109618 CVE-2026-10961911 · 4 reads

PHP patches critical unauthenticated RCE flaws called PHP2Shell

PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 fix two web-worker RCE bugs; in-the-wild attacks are not established.

Horizon3.aiupdated Oct 21, 23:02 UTC · 3d agofirst Oct 21, 14:50 UTC · 4d agoVulnerability 30 sourcesCVE-2026-109618 CVE-2026-1096192 · 1 read

Related CVEs

by mentions

CVE-2026-109619100%9.2
Use-after-free RCE in PHP via stale request globals
published 4d agophpPoC ×13
CVE-2026-10961812%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 4d agophpPoC ×25

Appears with

PHPvendor · 3
PHP-FPMproduct · 3
FrankenPHPproduct · 2
LiteSpeedproduct · 2
php-cgiproduct · 1
Rapid7organization · 1
NCSC Netherlandsorganization · 1
Horizon3.aiorganization · 1
CERT-EUorganization · 1

Entities are extracted by the model from each article. First seen Oct 21, 2026, last mentioned 3d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.