PHP (php.net news archive, security announcements)
php-net-news · A · candidate
https://www.php.net/archive/2026.php
Added 2026-10-22 (2026-10-22T0256Z-intel): S1: first-party announcements for PHP security releases, which now carry critical unauthenticated remote code execution (PHP2Shell); `extract` reads the archive page with the newest item first, and no PHP-specific record existed. Candidate: promote to active after 3 contributing runs.
Cited in 3 entries
Citation cadence
Citation days per ISO week (24 weeks of coverage span, total 3).
- CVE-2026-109618 / CVE-2026-109619, Palo Alto Networks PAN-OS and Panorama: the PHP2Shell flaws affect the management web interface of every release, with no fixed release on any train2026-10-22
- CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)2026-10-21
- CVE-2026-6722: PHP SOAP extension use-after-free in the ref_map deduplication can lead to code execution, fixed in PHP 8.2.31 to 8.5.62026-05-11