CVE-2026-109618 — PHP Memory Corruption Vulnerability
PHP Memory Corruption Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on…
Tag: PHP
CVE-2026-109619 — PHP Stale Internal Request-State Vulnerability
PHP Stale Internal Request-State Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based…
Unpatched Kaltura mwEmbed Flaws Allow Remote File Read and Code Execution
CERT/CC has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library, mwEmbed (also distributed as html5lib), that allow remote, unauthenticated attackers…
CVE-2024-4577: PHP CGI Argument Injection
A critical argument injection vulnerability in PHP CGI, used by Evooo1Bot.
emer-run.php: PHP Web Shell Deployed in BdThemes Attack
emer-run.php is a PHP web shell installed via a fake plugin in the BdThemes supply chain attack, enabling remote code execution on…
Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw
A public proof-of-concept (PoC) has been released for CVE-2026-55200, a critical vulnerability in the libssh2 client-side SSH library. The flaw, with a…
PHP Uses libssh2
PHP deployments often include libssh2, making them a common carrier for the vulnerability.
Packagist: PHP Package Repository Used in Supply Chain Attack
Packagist is the main package repository for PHP that was used to distribute malicious development versions of 10 packages associated with a…
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity vulnerability affecting the Widget Factory Joomla Content Editor (JCE) to…