CISA Adds Two Critical PHP Flaws to Actively Exploited Vulnerabilities
CISA has recorded active exploitation of PHP flaws CVE-2026-109618 and CVE-2026-109619. Fixes have been available since October 21 across several supported branches.
Tag PHP
Imperva Demonstrates RCE Through the Node2Shell Flaw in Node.js
Imperva researchers demonstrated remote code execution through CVE-2026-111497 in a vulnerable Node.js image for Linux arm64. Fixes are available in releases 22.23.4, 24.22.1, and 26.12.1.
PHP Releases Emergency Fixes for Critical PHP2Shell Flaws as Exploitation Attempts Are Detected
The PHP project fixed two critical vulnerabilities enabling unauthenticated remote code execution. AWS detected exploitation attempts before the fixes were publicly disclosed.