PHP is not the story; it's the illustration. Reg columnist Rupert Goodwins on what last's week's PHP2Shell mayhem means for disclosure in the infosec world.
More here:
PHP2Shell: CVE-2026-109618 and CVE-2026-109619.
See how CrowdStrike Falcon helps you identify affected assets and container images, assess risk, and investigate potential exploitation.
Watch the technical demo:
PHP 8.5.12 may not have completely fixed the latest PHP security issue.
Security researcher Elise Boyd says a double-free crash still works on the patched version.
So far, it has only been demonstrated as a local command-line crash. There is no evidence that it can be exploited remotely, and PHP has not confirmed the finding.
PHP has warned about two serious security bugs that could put websites at risk.
The vulnerabilities can potentially let attackers run their own code on vulnerable web servers. PHP is used by websites and services running platforms such as WordPress, MediaWiki, Magento, Joomla, Drupal and more.
Some websites are temporarily taking parts of their services offline while they wait for more details about the bugs.
PHP 8.6.0 RC2 can now be installed from Laravel Herd!
It includes all PHP extensions (imagick, redis, sqlsrv, etc.) so you can make sure your apps are ready, when 8.6 releases on November 19 - so you have more time to play GTA 6 on launch day 😁
The PHP bug was known since 2004. Nobody patched it because no one could build an exploit. @zmanian on AI lowering the economic barrier to these attacks: