AWS bulletin lists PHP runtime flaws CVE-2026-109618 and CVE-2026-109619
A WAF rule named PHP2Shell blocks POSTs that pair PHPSESSID with PHP_SESSION_UPLOAD_PROGRESS.
Stories per day · 30 days
2 RSS
5 stories, newest first · one card per story
Stories tagged #session
PHP session upload-progress use-after-free posted before a patch
The author publishes a public framework and says stock PHP 8.2.34 and 8.4.4 can reach code execution.
6
CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation
Apache APISIX authz-keycloak can carry one request's permissions into later requests (CVE-2026-82806).
CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
Apache Airflow logout fails to revoke bearer tokens, leaving them valid until expiry.
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
Microsoft reports DeadLock ransomware using Polygon smart contracts and Session messaging for extortion infrastructure, claiming 96 victims across Europe and the U.S.
3