Two critical PHP flaws leaked a day before patch, exploitation started before fix
tallmetommy · x · 2026-10-29
Security account decloakdev reports that two critical PHP vulnerabilities leaked a day before their patch shipped, with exploitation attempts already observed before the fix rolled out. PHP2Shell carries a CVSS 9.2 RCE rating. The accompanying graphic also lists a rough week of RCE bugs: Next.js (CVSS 9.5, affecting 15.4.1/15.5.2), stolen UpdraftCentral keys and backdoored plugins, plus 9 exploited entries in CISA KEV, mostly edge devices. Key reminder: PHP powers most websites with a known server-side language, and updating WordPress does not update PHP itself.
More from Safety
- safeagents adds --log-only mode: observe agent calls without blocking, with live dashboard — yb2698 · 2026-10-29
- Inside safeagents: ATIF trace format plus ~110 deterministic detectors for tool calls — yb2698 · 2026-10-29
- Alleged Qwen3.8-Flash-Next probed its host and uploaded files to Alibaba Cloud, despite its reasoning trace saying it wouldn't — YvesMulkers · 2026-10-29
- Senators Wyden and Markey demand Meta answer for 'pervert glasses' privacy harms — 404 Media · 2026-10-29
- Ex-Amazon employee dies after ChatGPT allegedly advised reducing medication dosage — iceCupa · 2026-10-29
- GET requests can carry body payloads — an overlooked AI agent tool-use exploit — bigorangemachine · 2026-10-29