News
cybersecurity Ransomware Hackers Use Claude AI to Plan Attacks Against 62 Organizations, Researchers Reveal - CyberPress threat-intel INC Ransomware Hackers Use Claude AI, Expose 8,257 Messages and 46 Malware Builds - GBHackers cybersecurity Microsoft Changes Bug Bounty Rules, Requires Detailed Proof of Concept for Higher Rewards - CyberPress threat-intel Microsoft Introduces New Bug Bounty Rules That Could Affect Security Researchers’ Rewards - GBHackers cybersecurity Hackers Compromise 333 Tor Exit Nodes to Intercept SSH Connections and Steal Passwords - CyberPress threat-intel Hackers Exploit Compromised UpdraftCentral Keys to Install Malicious Plugins on WordPress Sites - GBHackers cybersecurity PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert - The Hacker News threat-intel eMudhra Security Incident Exposes Weak Private Keys Used to Sign Trusted Certificates - GBHackers threat-intel Two Critical PHP RCE Vulnerabilities With CVSS 9.2 Score Put Web Servers at Risk - GBHackers cybersecurity PHP warns it plans to release 2 emergency patches imminently - Ars Technica Security cybersecurity What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) - Aikido Security cybersecurity Stolen UpdraftCentral keys used to backdoor WordPress sites - BleepingComputer vulnerability 2026-018: Critical Vulnerabilities in PHP - CERT-EU Security Advisories vulnerability Oracle October 2026 Critical Patch Update Addresses 1209 CVEs - Tenable Security Research cybersecurity Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys - Dark Reading
1 / 15
All news ›
Vulnerability

2026-018: Critical Vulnerabilities in PHP

CERT-EU Security Advisories ·

On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks. At this time, no technical details have been made public. CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available. The PHP team has scheduled the release for 21 October 2026 at 14:00 UTC.

Continue on CERT-EU Security Advisories ↗ ‹ All news Get the newsletter

The summary and image come from CERT-EU Security Advisories; the image is shown from their website.