// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Yesterday
-
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
Two PHP vulnerabilities affecting WordPress sites can allow unauthenticated code execution.
-
[remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
A remote code execution vulnerability in PHP core versions after 5.4, identified as CVE-2026-109618, is listed on Exploit-DB.
-
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
PHP project criticized Chainguard for its coordinated vulnerability disclosure approach, saying it could expose widely used web software to risk.
-
Wednesday, October 21, 2026 Security Releases
Security releases for the Node.js runtime were published on October 21, 2026, addressing vulnerabilities.
-
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
Microsoft attributes a ConnectWise supply-chain attack to a China-aligned group that used an automated AI framework to reach many tenants.
-
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution or denial of service on affected workers.
-
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) infocon yellow , (Wed, Oct 21st)
PHP.net will release a critical update for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.4, with early proof-of-concept exploits available.
# 21 Oct
-
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab issued fixes for an unauthenticated remote code execution flaw affecting self-managed instances since version 7.0.
-
CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
Attackers are actively exploiting four Plex Media Server vulnerabilities, according to CISA.
-
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940 used AI to accelerate a ConnectWise supply chain compromise and abuse application credentials in Microsoft 365 environments.
-
LiteLLM supply chain attack hoovers up passwords and secrets
A supply chain attack involving LiteLLM reportedly collected passwords and secrets and delivered a remote access trojan.
-
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
LiteLLM version 1.107.0 was compromised in a supply-chain attack that distributed a credential stealer and backdoor through PyPI and Docker images.
-
PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now
PHP has released security updates addressing two critical vulnerabilities that may allow unauthenticated remote code execution.
-
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, a scripting language used for web servers and CMS systems.
-
Multiple Vulnerabilities in PHP Could Allow for Remote Code Execution
PHP vulnerabilities may allow unauthenticated remote code execution in installations serving web requests.
-
Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability
A privilege escalation vulnerability exists in Cisco Secure Client's Secure Firewall Posture module due to insufficient IPC input validation.
-
Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability
A Snort 3 vulnerability lets an authenticated local low-privilege user execute arbitrary commands as the Snort process through an unauthenticated control channel socket.
-
Widespread PHP Flaw May Cause Many Site Outages Today
A pair of PHP vulnerabilities affecting many websites is being actively exploited and can allow attackers to take control of servers.
-
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
The PHP project released security updates for two critical unauthenticated remote code execution flaws affecting memory handling and request state.
-
Two critical RCEs in PHP core
Two critical remote code execution vulnerabilities in PHP core may affect PHP-based applications and services.
-
CVE-2026-109618 / CVE-2026-109619 | What is Known
Two PHP core flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution and are addressed in October 2026 security updates.