PHP CGI pointer underflow allows unauthenticated RCE (CVE-2026-109618)
Default cgi.fix_pathinfo exposes PHP 5.x through 8.4.26; only the 8.2 and later branches are scheduled to be fixed.
1 stories, newest first · one card per story
Default cgi.fix_pathinfo exposes PHP 5.x through 8.4.26; only the 8.2 and later branches are scheduled to be fixed.
Today 617 readers · 742 views · 563 reads · all time 158K views