#php
-
Attackers exploit critical authorization flaw in Drupal Commerce Core
Drupal warns that an access bypass vulnerability in its Commerce Core component is already being exploited in the wild. Users are urged to update promptly.
-
CISA warns Fragnesia Linux kernel flaw is being chained with PHP2Shell in attacks
The U.S. agency CISA has ordered federal agencies to fix a Linux kernel privilege escalation flaw. Attackers are already pairing it with the PHP2Shell bugs to gain root access to servers.
-
PHP2Shell flaws confirmed exploited in the wild for the first time
Researchers have recorded the first successful remote code execution via PHP2Shell — a pair of critical flaws that PHP developers have already patched. Until now, every exploitation attempt had come up empty.
-
That PHP Vulnerability Has No Easy Exploit
A new PHP bug sparked panic, but the author argues the thousands of GitHub "PoCs" don't work against a plain server. The culprit: blind faith in large language models.
-
PHP Rushes Out-of-Cycle Fix for Two Critical RCE Flaws
PHP's security team scheduled an emergency release for October 21 for two critical vulnerabilities rated 9.2 on CVSS v4.0. watchTowr researchers say both allow remote code execution, but no details have been published yet.
-
PHP preps emergency patches after two critical flaws leak early
The PHP security team is urging administrators to brace for urgent updates after details of two critical vulnerabilities leaked ahead of their planned disclosure.
-
A Temporary PHP Patch from 2014 Lived On Through 20 Million Installs
Developer Jake Smith has deprecated his http_build_url polyfill — 174 lines of code written as a stopgap for AOL's CMS that spread across millions of sites.
-
Exploit Published for Already-Patched Pre-Auth RCE in vBulletin
Researchers have disclosed CVE-2026-61511 — a vulnerability in vBulletin's template engine that allows code execution without authentication. The patch came out nearly a month before the exploit was published, but many forums still haven't updated.