News · via Microsoft Security Response Center
CVE-2026-96185 Microsoft Exchange Online Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
RCE
Coverage tagged "RCE".
News · via Microsoft Security Response Center
CVE-2026-96251 Microsoft PowerShell Remote Code Execution Vulnerability
Corrected Fixed Build Number and Download links in the Security Updates table. This is an informational change only.
News · via Schneier on Security
New Serious PHP Vulnerabilities Released and Patched
PHP maintainers have released two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users…
News · via Help Net Security
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on…
News · via CISA
Siemens Industrial Edge App Publisher
View CSAF Summary The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues…
News · via The Hacker News
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js…
News · via Zero Day Initiative
ZDI-26-788: Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Snort. Authentication is not required to exploit this vulnerability. The ZDI has assigned a…
News · via Zero Day Initiative
ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Megatron Bridge. User interaction is required to exploit this vulnerability in that the target…
News · via Zero Day Initiative
ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS…
News · via Wordfence
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service handling website…
News · via Exploit-DB
[remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
News · via Zscaler ThreatLabz
CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks
IntroductionOn October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,” were publicly disclosed. Both…
News · via GuidePoint Security
Keep Calm, and Patch PHP2Shell
Keep Calm and Patch PHP2Shell October 21, 2026 Justin Timothy With contributions by the GuidePoint Security GRIT team BLOG 10 min. How to Respond to CVE-2026-109618 and CVE-2026-109619 *Note: This is…
News · via The Hacker News
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in…
News · via Simon Willison
Today's PHP Security Release, and How We're Strengthening PHP Security
Today's PHP Security Release, and How We're Strengthening PHP Security If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote…
News · via Cisco PSIRT
Vulnerabilities in PHP Affecting Cisco Products: October 2026
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE…
News · via SecurityWeek
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
The two RCE bugs can be exploited against WordPress, Drupal, Joomla, and other popular applications.
News · via Wordfence
PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now
The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The…
News · via Rapid7
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
OverviewOn October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while…
News · via Kaspersky Securelist
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Vulnerability overview On October 20, 2026, the PHP security team published a preliminary notice regarding an upcoming emergency release that addresses two critical vulnerabilities (both rated 9.2 on…