PHP Patches Two Critical RCE Flaws That Were Already Under Attack

By Steef-Jan Wiggers · InfoQ · Sunday, 25 October 2026 at 18:07 (3h ago) · Original article ↗

PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities allowing unauthenticated remote code execution. Amazon recorded an exploitation attempt four days before the patches shipped, and operators spent the day working out whether they ran PHP, where to get the package, and how to tell it had landed.

You're reading a preview. The full article is published by InfoQ on their website.

Read the full story on InfoQ

Security

‘Cyberselfish’ author takes aim at Silicon Valley libertarians as her book returns from the dead

"That's a 12-year-old view of the world."

TechCrunch 1h ago

Security

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker…

The Hacker News 4h ago

Security

PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking

Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the attackers targeted a government entity in…

The Hacker News 4h ago

PHP Patches Two Critical RCE Flaws That Were Already Under Attack

More Security & Privacy

‘Cyberselfish’ author takes aim at Silicon Valley libertarians as her book returns from the dead

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking