Back to Zero Wire

Session

Security briefings tagged with Session

Needs attention

Active incidents, new guidance or unresolved scope that security teams should review now.

Last checked

Patch

php2shell

CVE-2026-109618 · CVE-2026-109619 · CVE-2026-115560

Two PHP runtime flaws can allow unauthenticated code execution, data exposure, or crashes. A related follow-up, CVE-2026-115560, adds a configuration-dependent session upload progress RCE vector.

Read the briefingRead the blog post

Why this needs attention

CISA has listed CVE-2026-109618 and CVE-2026-109619 as known exploited. The related CVE-2026-115560 requires a separate session-configuration assessment; exploitation of that follow-up is not established in the reviewed sources. These PHP runtime issues require attention beyond application-code or plugin updates.

What to do now

Patch the PHP runtime using the original security advisory and separately review PHP's session upload progress advisory for CVE-2026-115560. Keep compensating controls in place while patching, and ask managed hosting providers to confirm each issue's status.