Back to Zero Wire

PHP

Security briefings tagged with PHP

Needs attention

Active incidents, new guidance or unresolved scope that security teams should review now.

Last checked

Patch

php2shell

CVE-2026-109618 · CVE-2026-109619 · CVE-2026-115560

Two PHP runtime flaws can allow unauthenticated code execution, data exposure, or crashes. A related follow-up, CVE-2026-115560, adds a configuration-dependent session upload progress RCE vector.

Read the briefingBlogbeitrag lesen

Why this needs attention

CISA has listed CVE-2026-109618 and CVE-2026-109619 as known exploited. The related CVE-2026-115560 requires a separate session-configuration assessment; exploitation of that follow-up is not established in the reviewed sources. These PHP runtime issues require attention beyond application-code or plugin updates.

What to do now

Patch the PHP runtime using the original security advisory and separately review PHP's session upload progress advisory for CVE-2026-115560. Keep compensating controls in place while patching, and ask managed hosting providers to confirm each issue's status.

Reference

Stable briefings kept for reference. Reference doesn't mean every affected system has been patched.

Last checked

Update systems

WordPress SQL injection and RCE

CVE-2026-60137 · CVE-2026-63030

Two related WordPress flaws can expose database contents and allow unauthenticated code execution through distinct SQL-injection and REST API attack paths.

Read the briefingBlogbeitrag lesen

Why it remains relevant

Vendor remediation and applicability guidance are stable, and active exploitation was not established in the cited sources. The record remains relevant to organizations that have not verified their WordPress update state.

What to do now

Confirm WordPress update status against the vendor release and patch guidance. Keep any compensating controls in place while remediation is completed.