Threats
Vulnerabilities and patches
Breaches and privacy
Research
World
Learn
Monday 2 November
Global

Your region, kept on this device.

Get the appSign in

PHP

Product

Vulnerabilities

2 CVEs in our records, 2 known exploited (on CISA's KEV list).

2Critical
0High
0Medium
0Low
0No score
Source: NVD and CISA KEV

Am I affected?

Checked against NVD affected-version data on our server. Nothing you type is stored.

Affected versions

Source: NVD

End of support

  • PHP 8.2: security support ends 31 December 2026 (vendor)

Security timeline

  1. Vulnerability reported by Debian Security AdvisoriesDebian issues vim security update fixing 40 vulnerabilities
  2. Vulnerability reported by Federal News Network (Cybersecurity)CISA official criticises Chainguard for releasing a PHP bug early
  3. Vulnerability reported by SecurityWeekPHP2Shell attacks root Palo Alto firewalls but fail against WordPress
  4. Vulnerability reported by NCSC (UK)Critical PHP flaws CVE-2026-109618 and CVE-2026-109619 now exploited in the wild
  5. Vulnerability reported by Qualys Threat ResearchCISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue

Recent news

GBHackers·

October 2026 roundup lists cyberattacks on Binance, PHP, Node.js, LiteLLM and the Pentagon

A roundup of October 2026 security incidents covers a cryptocurrency platform, developer infrastructure, certificate authorities, government records, gaming accounts and retail operations. The headline names , , , LiteLLM and the Pentagon, but the excerpt is truncated and gives no details of the attacks. The article notes that confirmed breaches, malicious releases, vulnerable configurations and possible credential exposure need separate handling.

Am I affected?
Ask
1
Debian Security Advisories· · High

Debian issues vim security update fixing 40 vulnerabilities

advisory DSA-6600-1 covers 40 CVEs in Vim, spanning path traversal in the tar and zip plugins, buffer overflows and underflows, out-of-bounds reads and writes, crashes, and command or code injection. Several issues are reachable through netrw, NetBeans, completion, spell files and tag files, so the risk comes from opening untrusted content. Systems running Vim should install the Debian update.

Am I affected?
Ask
1
404 Media·

AO3 fanfiction archive offline for weeks after security incident

The Organization for Transformative Works, which runs Archive of Our Own (AO3), says a security incident has taken the site down for maintenance. Restoration is estimated at about two weeks and could take up to a month. The operator says it does not expect any data loss, and it has ruled out a link to the recent security issue because AO3 runs on Ruby on Rails.

Am I affected?
Ask
1
NCSC (UK)· · Critical

Critical PHP flaws CVE-2026-109618 and CVE-2026-109619 now exploited in the wild

Two memory-corruption flaws in , CVE-2026-109618 (out-of-memory handling) and CVE-2026-109619 (use-after-free in global state), allow unauthenticated remote code execution via crafted HTTP requests, with the risk greatest for Apache modphp. CISA added both to its Known Exploited Vulnerabilities catalogue on 26 October 2026, and advises upgrading rather than relying on configuration changes alone.

Am I affected?
Ask
12
Qualys Threat Research· · Critical

CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue

CISA added CVE-2026-111497 (Google , CVSS 9.2) and CVE-2026-48356 ( Commerce and Magento, CVSS 9.3) to its KEV catalogue, with federal agencies told to fix them by October 29, 2026. Sansec reported the Magento flaw, dubbed PolyShell, had been used to infect at least 953 online stores, while exploit traffic for the Brotli flaw has also been observed. Node.js, PHP, and Microsoft .NET have released fixes for Brotli.

Am I affected?
Ask
9