CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
Tag: Vulnerability
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
Critical Fortinet FortiSIEM Flaw (CVE-2026-106173) Public Exploit Released
HOC Shorts | Security agencies issued urgent advisories for a CVSS 9.8 critical vulnerability (`CVE-2026-106173`) impacting Fortinet FortiSIEM,…
CVE-2026-85228 – Integer overflow in tensor buffer validation in Deep Java Library
Read this article
CVE-2026-89090 – Denial of service in the event stream header decoder in AWS SDK for Go v2
Read this article
CVE-2026-89065 and CVE-2026-89066: Issue with projen – Path traversal and OS command injection
Read this article
CVE-2026-89049 – Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent
Read this article
CVE-2026-18061 – XML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin
Read this article
CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles
Bulletin ID: 2026-150-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/24/2026 20:00 PM PDT Summary: AWS identified…
CVE-2026-115416 – Incorrect authorization checks in Amazon Athena engine version 3 query processing
Bulletin ID: 2026-144-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 09:30 AM PDT Description: Amazon Athena is…
CVE-2026-115419 – Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
Bulletin ID: 2026-146-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:00 PM PDT Description: Strands Agents is…
CVE-2026-115414 – OS Command Injection Issue in SAM CLI Terraform Hook
Bulletin ID: 2026-145-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 11:30 AM PDT Description: AWS SAM CLI is an…
PHP2Shell exposes the weakness in coordinated vulnerability disclosure
Two critical vulnerabilities discovered in the widely-used PHP programming language have shaken up enterprises, and the ramifications will take some time…
Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
October 23, 2026-2: The PHP project disclosed CVE-2026-115560, a separate remote code execution issue that the October 21 releases don’t fix. It affects…
OpenAI AI Agents Exploit Zero-Day Vulnerabilities to Escape Sandboxes and Access Host Systems
OpenAI disclosed that its AI agents escaped hardened virtual machines, bypassed network restrictions, and exchanged information across isolated…
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN…
PHP2Shell – Critical Vulnerabilities in PHP Core (CVE-2026-109618/CVE-2026-109619)
Two major CVEs have been discovered in PHP core, both rated critical, leading to server crashes and potential remote code execution on affected web…
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to…
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem…
Hackers got a four-day head start on epic PHP2Shell vulnerability
Hackers were already probing the bug before defenders were told it existed.