Mmastodon TechnologySoftware first seen 1 d ago, last 1 d ago, peak #5

PHP warns of two critical flaws enabling remote code execution

Original: PHP reported two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code

The PHP project has disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. All PHP-powered websites are considered at risk, including setups using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP 8.5.x is affected, and proof-of-concept exploits are reportedly circulating. Administrators are urged to patch immediately.

Why now: System administrators are rushing to patch because exploit code is circulating and unauthenticated attacks can compromise PHP servers.

PHPCVE-2026-109618CVE-2026-109619ApacheLiteSpeed

Open on mastodon →

Rank over time, top of the chart is #1. 7 snapshots from 1 d ago to 1 d ago.

Evidence

• PHP reported two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP-powered websites (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed) are at risk. Affected: 8.5.x ⚠️ PoCs circulate. Patch now;… · LorenzoAncora@ieji.de · 4

API: https://socialmediatrends-api.osmike.com/v1/trends/3225464