VLC Media Player Hit by Two Memory Corruption Flaws Exploitable via Malicious PNG and Rogue RealRTSP Server
VLC media player contains two memory corruption vulnerabilities that can be triggered without any special configuration or plugins.
The more severe flaw, CVE-2026-56711, received an 8.6 CVSS 4.0 score. It is caused by an integer overflow during buffer-size calculation for PNG images. An attacker can supply an image with abnormally large width and height values, forcing VLC to allocate an undersized memory region and then write data beyond its boundaries. The vulnerability activates when a malicious PNG is opened directly or referenced inside a playlist.
The second issue, CVE-2026-73324, carries a 6.9 CVSS score and affects the RealRTSP module. A malicious server can return a response string longer than 4096 bytes that lacks a terminating null character. As a result, VLC continues reading memory past the intended buffer, potentially disclosing adjacent data to the attacker-controlled server.
Both vulnerabilities impact official VideoLAN builds of VLC versions 3.0.0 through 3.0.23. Some Linux distributions may ship the player without the RealRTSP module enabled. Until patched versions are released, users should refrain from opening images or playlists from untrusted sources and avoid connecting to unknown RealRTSP streams.
Related articles
PHP Foundation Reveals Two Critical RCE Vulnerabilities Fixed After 2024 Discovery Delays
The PHP Foundation has disclosed details surrounding two severe remote code execution vulnerabilities in PHP that were addressed in updates released on October 21, 2026. The issues, tracked as CVE-2026-109618 and CVE-2026-109619, affect memory management and error handling routines used in nearly every request. Although signs of one flaw were identified during an external audit in 2024, resource constraints and prioritization of other issues delayed remediation. The foundation had planned a coordinated disclosure, but information leaked prematurely, causing confusion among stakeholders. Updated versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are now available, and immediate patching is strongly recommended for all users. The vulnerabilities' broad impact and the challenges in balancing security fixes with performance considerations made the response particularly complex.
CISA Urges Immediate Patching of Critical PHP Remote Code Execution Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding two severe vulnerabilities in the PHP programming language that allow unauthenticated remote code execution. Identified as CVE-2026-109618 and CVE-2026-109619, the flaws affect all environments processing web requests with PHP and have been nicknamed php2shell. CISA recommends applying patches to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 without delay, or taking affected systems offline if updates cannot be applied immediately. Although no exploitation has been observed yet, organizations are instructed to inventory PHP usage, prioritize internet-facing systems, and monitor for suspicious activity such as shell processes spawned from PHP workers. Web application firewalls may offer partial protection but are not considered a substitute for patching.
GitLab Issues Critical Patches for CVE-2026-110264 Affecting Wide Range of Versions
GitLab has released emergency security updates to address multiple vulnerabilities, including one rated critical that allows unauthenticated remote code execution. The flaw, tracked as CVE-2026-110264, stems from an integer overflow in the regular expression compiler and carries a maximum CVSSv3.1 base score of 10.0. It impacts GitLab Community Edition and Enterprise Edition starting from version 7.0, with patches now available for both current and older branches. The company strongly urges immediate updates due to the severity and potential for arbitrary code execution on affected servers. Additional lower-severity issues were also resolved in the same release cycle.
PHP Issues Emergency Patches for Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released urgent patches for two critical vulnerabilities collectively known as PHP2Shell that enable unauthenticated remote code execution on affected servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, score 9.2 on CVSS v4.0 and have already seen active exploitation attempts with malicious payloads adjusted to bypass WAF rules. The issues affect multiple PHP deployment methods including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, and do not require complex application code to be exploitable. CVE-2026-109618 involves a memory corruption chain leading to code execution under the web process privileges, while CVE-2026-109619 stems from an obsolete global state issue causing use-after-free conditions that can result in memory disclosure and code execution. Patched versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with administrators advised to restart all persistent workers after updating. Temporary mitigations such as setting memory_limit to -1 and disabling session.upload_progress.enabled are available for environments that cannot patch immediately.