Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Oracle Linux Security Advisory ELSA-2026-48170 announces updated RPM packages for PHP version 8.3.32 for x86_64 and aarch64 architectures, addressing vulnerabi…
Fedora has released PHP version 8.5.9, addressing various bugs, security issues, and improving functionality across multiple components, ensuring better stabil…
Debian Security Advisory DSA-6406-1 addresses multiple vulnerabilities in PHP 8.4 that could lead to denial of service, SQL injection, and arbitrary code execu…
Rocky Linux 9 has released a critical PHP update addressing multiple vulnerabilities, including remote code execution and denial of service, as detailed in the…
Several security issues were fixed in PHP.
Important: php:7.4 security update
Important: php:7.4 security update
Important: php:7.4 security update
PHP version 8.4.21 (07 May 2026) Core: Fixed bug GH-19983 (GC assertion failure with fibers, generators and destructors). (iliaal) Fixed bug GH-21478 (Forward …
MGASA-2026-0127 - Updated php packages fix security vulnerabilities
It was discovered that the AES-CBC implementation in the PHP Secure Communications Library was susceptible to a padding oracle timing attack. For the oldstable…
It was discovered that the AES-CBC implementation in the PHP Secure Communications Library was susceptible to a padding oracle timing attack. For the oldstable…
Two vulnerabilities were discovered in php-dompdf, a PHP library to convert HTML to PDF. CVE-2021-3838 php-dompdf is vulnerable to PHAR deserialization due to …
MGASA-2025-0330 - Updated php packages fix security vulnerabilities
PHP version 8.4.16 (18 Dec 2025) Core: Sync all boost.context files with release 1.86.0. (mvorisek) Fixed bug GH-20435 (SensitiveParameter doesn't work for nam…
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelector…
USN-7648-2 introduced a regression in PHP
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language, which could result in server side request forgery or …
Several security issues were fixed in PHP.
PGSQL: Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735) SOAP: Fixed GHSA-453j-q27h-5p8x (NULL Pointer Der…
Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the sec…
Multiple vulnerabilities have been discovered in PHP, the worst of which could lead to arbitrary code execution.
It was discovered that there was a remotely exploitable vulnerability in php-laravel-framework, a popular web application framework written in PHP.
Cybersecurity researchers have discovered a new PHP-based backdoor called Glutton that has been put to use in cyber attacks targeting China, the United States,…
