Skip to content

/

ZeroHour

ZeroHour aggregates public sources — security and AI press, vendor advisories, NVD, CISA KEV, FIRST EPSS, leak-site trackers and Have I Been Pwned — and classifies them with AI. Summaries can be wrong: read the original. All times are UTC.

News CVEs Incidents Tags Daily brief Traffic Sources RSS & API Kiosk Health Sitemap

Home
News feed
Exploited now

Security

CVEs
Ransomware & breaches
Threat actors & entities
IOCs

AI

AI & models

Explore

Tags
Daily brief
Analytics
Traffic & readers
Ask the feed
Sources

You

Watchlist
Saved
RSS, API & alerts

07:57 UTC· 5m ago

#php — news, CVEs and analysis · ZeroHour

today 46 visits · 59 views · 7 reads·all time 17K views

Tag

#php

4 stories this week · 14 this month · 18 in 6 months · mostly security

stories per day · 30 days

Related#cms 7 #rce 7 #flextype 6 #wordpress 4 #patch 3 #path-traversal 3 #click2shell 2 #cve-2026-87902 2 #denial-of-service 2 #shortcodes 2 #ubuntu 2 #advisory 1 #api 1 #auth-bypass 1 #canada 1 #cisa 1 #csrf 1 #deserialization 1

11 stories, newest first · one card per story

Security Affairs·1d ago high

U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog

#wordpress #cisa #kev

16 sources in the wild

BleepingComputer·1d ago high

WordPress Click2Shell flaw lets hackers execute PHP on the server

#wordpress #click2shell #csrf

6 sources 3 min

Canadian Centre for Cyber Security·15d ago

MongoDB security advisory (AV26-911)

#advisory #canada #java-driver

2

Exploit-DB·16d ago

[remote] CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE

#deserialization #exploit-release #ilias

CVE-2026-80428

1

Ubuntu Security Notices·16d ago

USN-8743-1: PHP vulnerabilities

#denial-of-service #out-of-bounds-write #phar

CVE-2026-17543

2

Ubuntu Security Notices·19d ago

USN-8734-1: PHP vulnerabilities

#denial-of-service #patch #php

CVE-2026-7262

Full Disclosure·23d ago

Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion

#cms #file-inclusion #flextype

Vulnerability

The Hacker News·Aug 26, 2026 high

Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

#cert-cc #deserialization #file-read

5 min1

Security Affairs·Aug 25, 2026 critical

Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable

#actively-exploited #algorithm-confusion #authentication-bypass

in the wild 5 min

Patchstack·Aug 12, 2026 high

When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE

#file-upload #imagemagick #imagick

Vulnerability

CERT/CC Vulnerability Notes·Aug 10, 2026

VU#614868: OpenCart ecommerce platform contains directory traversal vulnerability

#cve-2026-18412 #directory-traversal #e-commerce

CVE-2026-18412

1