CISA confirms active exploitation of PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while many appliance and EOL runtimes have no direct patch.
Stories per day · 30 days
1 RSS
Relatedgoahead2php2tls2embedthis1end-of-life1exploit-attempts1infocon1kev1libressl1mbed-tls1mutual-tls1openssl1ot1php2shell1
3 stories, newest first · one card per story
Stories tagged #embedded-devices
GoAhead 6.1.1 fixes three TLS flaws in embedded web servers
A critical OpenSSL-backend bug can accept revoked client certificates; the other flaws weaken DHE or chain checks.
SANS drops Infocon to green after coordinated PHP patches
No reliable public exploit is known, though firms claim private code and scanners report many attempts.