63 médias en ont parlé
Tech and Security Companies Respond to PHP2Shell Vulnerabilities ↗
links.tldrnewsletter.com · 23 oct.
Titre original (traduit automatiquement) : PHP warns admins of two critical flaws, emergency patches coming tomorrow
Si vous administrez un serveur web : appliquer les mises à jour de sécurité dès leur disponibilité ; si vous gérez un site WordPress ou similaire : contacter votre hébergeur pour vérifier que les correctifs sont appliqués.
PHP alimente une grande partie d'internet, notamment WordPress et les systèmes de gestion de contenu. Si vous utilisez un site web, un blog ou une plateforme en ligne, vous êtes potentiellement affecté par ces failles qui pourraient permettre aux pirates de prendre le contrôle de vos données ou de votre site.
Synthèse
PHP, le langage de programmation utilisé par des millions de sites web, contient deux failles de sécurité critiques (CVE-2026-109618 et CVE-2026-109619) découvertes le 21 octobre 2026. Ces failles permettent à des pirates d'exécuter du code malveillant à distance sur les serveurs affectés sans avoir besoin de s'authentifier.
On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks. At this time, no technical details have been made public. CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available. The PHP team has scheduled the release for 21 October 2026 at 14:00 UTC.
Tech and Security Companies Respond to PHP2Shell Vulnerabilities ↗
links.tldrnewsletter.com · 23 oct.
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge ↗
securityweek.com · 23 oct.
Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) ↗
digitalocean.com · 23 oct.
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches ↗
thehackernews.com · 23 oct.
PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet ↗
securityaffairs.com · 23 oct.
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware ↗
thehackernews.com · 23 oct.
Hackers got a four-day head start on epic PHP2Shell vulnerability ↗
arstechnica.com · 22 oct.
PHP: The three little letters wreaking havoc across the web ↗
theverge.com · 22 oct.
Oct. 22 - ‘PHP2Shell’ Bugs Put Security Industry on Red Alert | Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Dark Reading · 22 oct.traduit
PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports ↗
securityaffairs.com · 22 oct.
[tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner
Clint Gibler · 22 oct.traduit
Understanding PHP2Shell: Everything You Need to Know ↗
akamai.com · 22 oct.
Widespread PHP Flaw May Cause Many Site Outages Today ↗
krebsonsecurity.com · 22 oct.
New Serious PHP Vulnerabilities Released and Patched ↗
schneier.com · 22 oct.
Amazon says PHP2Shell exploitation began 4 days before patches ↗
bleepingcomputer.com · 22 oct.
Oct. 22 - ‘PHP2Shell’ Bugs Signal Red Alert for Security Industry
Dark Reading · 22 oct.traduit
AI-discovered PHP vulnerabilities force websites offline ↗
apnews.com · 22 oct.
Tech and Security Companies Respond to PHP2Shell Vulnerabilities ↗
securityweek.com · 22 oct.
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 ↗
helpnetsecurity.com · 22 oct.
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers ↗
helpnetsecurity.com · 22 oct.
PHP2Shell Exploitation Started Days Before Patches ↗
securityweek.com · 22 oct.
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed ↗
thehackernews.com · 22 oct.
Okta's Response to PHP2Shell ↗
sec.okta.com · 22 oct.
PHP2Shell: GitLab helps find and remediate critical PHP flaws ↗
about.gitlab.com · 22 oct.
'PHP2Shell' Bugs Signal Red Alert for Security Industry ↗
darkreading.com · 21 oct.
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors ↗
securityweek.com · 21 oct.
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 ↗
unit42.paloaltonetworks.com · 21 oct.
PHP2Shell Vulnerabilities Put 70% of Websites at Risk ↗
tidbits.com · 21 oct.
Multiple Vulnerabilities in PHP Could Allow for Remote Code Execution ↗
cisecurity.org · 21 oct.
PHP2Shell Makes PHP Inventory and Patch Ownership Urgent ↗
sonatype.com · 21 oct.
Two critical RCEs in PHP core ↗
blog.talosintelligence.com · 21 oct.
Hundreds of websites taken offline as concern grows over two PHP vulnerabilities ↗
therecord.media · 21 oct.
PHP ships emergency patches for critical PHP2Shell flaws ↗
bleepingcomputer.com · 21 oct.
Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 ↗
cloud.google.com · 21 oct.
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge ↗
thehackernews.com · 21 oct.
PHP patches released for two critical RCEs ↗
lwn.net · 21 oct.
PHP2Shell: Critical PHP vulnerabilities patched, update now! ↗
helpnetsecurity.com · 21 oct.
Critical Remote Code Execution Vulnerabilities in PHP Core ↗
akamai.com · 21 oct.
US Government Orders DeepSeek Out of Federal Civilian Systems ↗
securityaffairs.com · 21 oct.
Critical Vulnerabilities in PHP Require Immediate Patching ↗
cisa.gov · 21 oct.
Critical security issue affecting PHP ↗
ncsc.gov.uk · 21 oct.
PHP warns admins of two critical flaws, emergency patches coming tomorrow ↗
links.tldrnewsletter.com · 21 oct.
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't ↗
thehackernews.com · 21 oct.
PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws ↗
securityaffairs.com · 21 oct.
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws ↗
securityweek.com · 21 oct.
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell ↗
crowdstrike.com · 21 oct.
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert ↗
thehackernews.com · 21 oct.
A critical PHP security release is coming today, so get ready to update! ↗
helpnetsecurity.com · 21 oct.
PHP warns it plans to release 2 emergency patches imminently ↗
arstechnica.com · 21 oct.
Upcoming Critical PHP Security Release ↗
php.net · 20 oct.
Critical PHP security update coming ↗
lwn.net · 20 oct.
PHP warns admins of two critical flaws, emergency patches coming tomorrow ↗
bleepingcomputer.com · 20 oct.
