Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Multiple security vulnerabilities have been discovered in the MongoDB driver for PHP, which could result in denial of service. For the stable distribution (tri…
CISA added the widely publicized PHP vulnerabilities to the KEV, but didn't specify what kind of exploitation it was observing.
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages includ…
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has…
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new i…
php:7.2 security update
php:8.0 security update
PHP has released emergency updates for two critical vulnerabilities that can let attackers run malicious code on a web server without logging in.
Important: php security update
The package php-legacy before version 8.3.36-1 is vulnerable to arbitrary code execution.
The package php before version 8.5.12-1 is vulnerable to arbitrary code execution.
Multiple vulnerabilities have been found in PHP, the worst of which could result in remote code execution.
In a lengthy statement about two critical vulnerabilities, the PHP Foundation explained how one dated to 2024, how a recent third-party review by AI companies …
PHP could be made to crash or run programs if it received specially crafted network traffic.
The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.
Two critical vulnerabilities were found in PHP, a widely-used open source general purpose scripting language, which could result in remote execution of arbitra…
PHP could be made to crash or run programs if it received specially crafted network traffic.
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tr…
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fix…
It was discovered that incorrect memory state tracking in PHP, a widely-used open source general purpose scripting language, could result in the execution of a…
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on…
PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVS…
php:7.4 security update
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information abou…
