## Summary PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset ...
RCE via OOM corruption
## Summary PHP uses `longjmp()` for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it ...
PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619)
PHP fixed two remote code execution bugs on October 21. They affect PHP 5.4 and later. An attack needs specific knowledge of the target server and specific c...
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
PHP ships emergency patches for critical PHP2Shell flaws
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.
Critical security issue affecting PHP
Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
php2shell PHP-FPM exploit - phpMyAdmin, WordPress, and phpbleed
PHP developers issue updates to fix vulnerabilities, says flaw was found in 2024
Developers of the PHP programming language said a set of new updates fixing two previously identified critical vulnerabilities was now live, and acknowledged a delay in addressing a previously identified flaw.
vincent on Twitter / X
Session management is working and now it will keep the model in memory instead of constantly loading. Now to fix the hardest part, gibberish issue.ALMOST THERE ~80% DONE 🔨🔨🔨Demo: @UnslothAI Llama 3.2 1B on CPU3.6 tokens/sec to about 4.1 tokens/sec (gibberish) pic.twitter.com/1tp8dXQrLo— vincent (@t0kenl1mit) August 5, 2025
PHP warns it plans to release 2 emergency patches imminently
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
PHP CVE-2026-109618 and CVE-2026-109619: how to apply the patches
Install the fixed PHP for CVE-2026-109618 and CVE-2026-109619 on Ubuntu, Debian and RHEL, restart the right processes, and roll back the early mitigations.
Finland temporarily shuts down government websites as a precaution for critical vulnerabilities
The move is due to vulnerabilities found in widely used PHP software, which acts as the primary back-end backbone of the web.
