Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

cloudflare

Cloudflare deploys protections against php2shell vulnerability

Oct 21, 2026 By Managed Rules In Cloudflare
Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic.
Read Post
sophos

Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Oct 21, 2026 By Sophos Counter Threat Unit Research Team In Sophos
In response to requests, this update consolidates the Sophos countermeasures that relate the PHP2Shelll vulnerabilities. SophosLabs has developed the following countermeasures to specifically detect activity associated with this threat. The next table lists additional pre-existing Sophos countermeasures that will likely address post-exploitation activity associated with these vulnerabilities.
Read Post
CrowdStrike

CrowdStrike Protects Customers from Threats Delivered via PHP2Shell

Oct 21, 2026 By Amit Serper In CrowdStrike
Two critical memory-corruption remote code execution (RCE) vulnerabilities, collectively dubbed PHP2Shell, have been disclosed in core PHP, the underlying engine powering a vast portion of the web. The CrowdStrike Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of both vulnerabilities.
Read Post
tanium

PHP2Shell: Responding to CVE-2026-109618 and CVE-2026-109619

Oct 21, 2026 By Guardian Research Team In Tanium
If you run PHP anywhere in your environment, patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. Two critical flaws disclosed this week, CVE-2026-109618 and CVE-2026-109619 (nicknamed "PHP2Shell"), let an unauthenticated attacker run code on a server with nothing more than a crafted web request. Both carry a CVSS v4.0 score of 9.2, every earlier release is affected, and exploitation in the wild has been reported. The patch is the easy part.
Read Post
bitsight

CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): Two Critical PHP Remote Code Execution Flaws

Oct 21, 2026 By João Cruz In BitSight
The PHP security team has announced an emergency security release for Wednesday, October 21, 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both bugs are described as remote code execution issues, meaning an attacker could get their own commands running on a vulnerable server. The route to disclosure was messy.
Read Post
ioncube24

How to Manage Debugging and Customisation in Encoded PHP Applications

Jun 15, 2026 By Ben In ionCube24
Encoding PHP is not just a security decision, it’s a deployment decision. It affects how your application is maintained, debugged, and extended over time. It’s important to consider how the needs of your users may change after you deploy your application – sometimes that includes the need for fixes or small adjustments. Managing what you encode with ionCube When PHP files are encoded the original source code is completely removed from files.
Read Post
ioncube24

ionCube Loader - Running existing encoded files on future PHP versions

Jun 8, 2026 By Ben In ionCube24
ionCube Loader is the runtime partner to ionCube Encoder which actually runs your encoded files on deployment machines. One useful feature of the Loader is that it includes runtime compatibility support which allows existing encoded files to run on future PHP versions where technically possible. This capability helps software vendors adopt newer PHP releases with greater flexibility as they won’t always need to re-encode and redistribute code in order to support new PHP versions.
Read Post

Laravel APP_KEY Leaks Lead to RCE: GitGuardian + Synacktiv Reveal Massive Threat

Aug 19, 2025 By GitGuardian In GitGuardian
In this video, cybersecurity researcher Guillaume Valadon of GitGuardian breaks down how exposed Laravel APP_KEYs on GitHub can lead to full Remote Code Execution (RCE) in real-world applications. Working in collaboration with Synacktiv, the team uncovered 260,000 exposed keys, validated 600+ vulnerable apps, and revealed that over 35% of leaks also exposed critical credentials like database passwords, cloud storage tokens, and API keys.
View Video

User Logins for in-house PHP Apps and Sites with Connectors

Feb 25, 2025 By miniOrange In miniOrange
miniOrange connectors improve your PHP apps' and sites’ security by implementing SSO, MFA, and user synchronization. With a wide range of protocol support like SAML, LDAP, and OAuth, miniOrange connectors will improve your security, effectiveness, and efficiency in your workflow. Securing PHP applications and websites is made easier with miniOrange connectors. Timestamps: miniOrange, a trusted name in identity and access management, empowers organizations worldwide with robust, scalable, and secure solutions.
View Video
ionix

Understanding CVE-2024-50340 - Remote Access to Symfony Profiler

Nov 12, 2024 By Nethanel Gelernter In IONIX
According to security researcher nol_tech CVE-2024–50340 is a critical vulnerability (CVSS: 7.3) affecting Symfony applications when the PHP directive register_argc_argv is enabled. By appending ?+--env=dev to a URL, attackers can force the application into the dev environment, granting remote access to the Symfony profiler. This exposure can lead to the leaking of sensitive information and potentially executing arbitrary code.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.