Critical PHP Core Flaws Enable Unauthenticated Remote Code Execution
The PHP project issued emergency patches on 21 October for two critical vulnerabilities in the core of the language, identified as CVE-2026-109618 and CVE-2026-109619 and jointly called PHP2Shell. Both flaws received a CVSS 4.0 score of 9.2 and permit remote code execution without any authentication.
CVE-2026-109618 lies in memory-handling code. Use of longjmp can leave request data only partially initialized, after which shutdown routines operate on invalid structures. A multipart request containing numerous headers or an empty file field is sufficient to trigger the condition.
CVE-2026-109619 affects stale global state inside long-lived workers that continue to reference memory already freed. Confirmed exploitation paths involve fatal errors, error-report data, and session-upload progress tracking.
Researchers validated unauthenticated remote code execution over HTTP against the first vulnerability on Apache with mod_php under default configuration limits. On PHP-FPM the issue was confirmed through static analysis, although no public exploit has been demonstrated. Exposure to the second flaw depends on specific configuration settings and loaded extensions.
The FBI Cyber Division published an alert on 21 October directing administrators to apply updates immediately or take affected systems offline if patching is not feasible. The advisory recommends inventorying all PHP deployments, with priority given to internet-facing instances and embedded products.
Affected versions are those prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and earlier branches receive no further support from the project. Cloudflare deployed WAF rules across all plans; its CTO Dane Knecht stated that the company had already observed initial exploitation attempts.
Complete mitigation requires updating PHP and restarting all workers while verifying every pool and exposed service, because updating only the command-line package may leave PHP-FPM or the Apache module untouched. As a temporary workaround the project recommends limiting request and multipart body sizes at the frontend and, on PHP 8.5, disabling fatal_error_backtraces together with session upload progress.
Related articles
Two Critical RCE Vulnerabilities Patched in PHP with CVSS 9.2 Scores
The PHP development team has disclosed two severe remote code execution vulnerabilities affecting the widely used scripting language. Both issues, tracked as CVE-2026-109618 and CVE-2026-109619, received a CVSSv4.0 base score of 9.2 and were rated Critical. The flaws stem from improper memory handling during request processing and cleanup phases. Exploitation could allow attackers to execute arbitrary code by manipulating uninitialized or residual data in worker processes. Security updates addressing both vulnerabilities were released on October 21, 2026, and users are strongly urged to apply the patches immediately. The advisories were previewed the previous day, highlighting the urgency of the fixes.
Oracle Releases October 2026 Critical Patch Update Fixing 1,295 Vulnerabilities Across Multiple Products
Oracle has published its quarterly Critical Patch Update (CPU) on October 20, 2026, delivering a total of 1,295 security patches for a wide range of products. After removing duplicates, the update addresses 1,209 unique CVEs. The highest number of fixes went to Oracle Fusion Middleware with 206 patches, followed by Oracle E-Business Suite with 194, Oracle Communications with 110, Oracle MySQL with 98, and Oracle Java SE with 55. Among the vulnerabilities, 587 received a CVSSv3 base score of 7.0 or higher, including 112 rated 9.0 or above. Six vulnerabilities scored the maximum 10.0, one of which is CVE-2026-101809 in Oracle E-Business Suite Workflow Notification Mailer that can be exploited remotely without authentication over HTTP.
Why Traditional Vulnerability Scanners Fail in Kubernetes and Cloud Environments
Traditional vulnerability management approaches break down when applied to containers and cloud infrastructure because containers are ephemeral, internal networks are invisible from the outside, and misconfigurations can be introduced at build time. The article highlights the 2018 Tesla Kubernetes incident where an exposed dashboard allowed cryptomining via stolen AWS credentials without any code vulnerabilities. Container security tools are required to scan images during build, enforce policies at deployment, and monitor runtime behavior, unlike classic scanners that only examine running workloads. Key configuration risks include privileged pods, missing NetworkPolicy objects, and overly broad RBAC roles such as cluster-admin. Supply chain protections like Sigstore image signing and SBOM generation are presented as essential for preventing compromised base images and hidden dependencies. Cloud environments add shared responsibility models, dynamic scaling challenges, and regulatory constraints that further limit the effectiveness of legacy VM tools. Specialized platforms such as CNAPP solutions are recommended alongside Russian domestic tools like PT Container Security and Kaspersky Container Security.
Google Releases Chrome 156 Fixing 353 Vulnerabilities Including Six Critical Issues
Google has released Chrome 156 for Windows, macOS, and Linux, addressing a total of 353 vulnerabilities tracked via CVE identifiers. Six of these flaws received the highest Critical severity rating, primarily involving memory corruption in components such as Skia, Accessibility, CSS, Paint, and WebRTC. One additional Critical issue is a Use-After-Free vulnerability in Accessibility reported by Anthropic researcher Xinyang Ge with assistance from Claude. Sixty-one High severity vulnerabilities were also fixed across V8, ANGLE, WebRTC and other modules, covering memory corruption, use-after-free conditions, and input validation problems. The update further resolves 197 Medium and 89 Low severity issues. Patches are being deployed gradually over the coming days and weeks to all supported platforms.