NCSC advisory details the two PHP flaws enabling unauthenticated remote code execution
LuizaJarovsky · x · 2026-10-22
A follow-up sharing the NCSC's official advisory: PHP has shipped a security update for two critical flaws — an out-of-memory handling issue (CVE-2026-109618) and a use-after-free of request state (CVE-2026-109619) — that under certain conditions enable unauthenticated remote code execution. All organizations using PHP are urged to update.
More from Safety
- US states restrict retinal images as PII, threatening medical AI research — pearsekeane · 2026-10-22
- Generator Residency pays $8,500/month for a 3-month AI safety program in Berkeley — alexcovo_eth · 2026-10-22
- GoDaddy revokes 404,607 TLS certificates after mismatch flagged; 177k still pending — natesiggard · 2026-10-22
- Former FTC Chair Lina Khan calls today's AI exceptionalism "ludicrous" in AI governance talk — AINowInstitute · 2026-10-22
- Constitutions for the multiagent era: how AI constitutions can govern agent organizations — sethlazar · 2026-10-22
- CVE batch disclosure is like a 17-year cicada emergence, researcher argues — moultano · 2026-10-22