Security1 hOctober 27, 2026, 19:45

PHP2Shell patch leaves session-poisoning LFI-to-RCE open

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix out-of-memory corruption and stale worker state (CVE-2026-109618 and CVE-2026-109619), but patched hosts still ship with session.upload_progress.enabled=1 by default. That turns a dormant LFI into an unauthenticated two-request RCE; CISA added both CVEs to its KEV catalog with an October 29 deadline.

DEV Community

Open source

PHP2Shell patch leaves session-poisoning LFI-to-RCE open

CVE-2026-109618 and CVE-2026-109619 affect PHP 5.4 through 8.5
Fixes shipped in 8.2.35, 8.3.36, 8.4.27 and 8.5.12
Default session.upload_progress.enabled=1 allows session file writes
CISA added both CVEs to KEV with an October 29 deadline

#PHP#CISA

Palo Alto patches actively exploited PAN-OS management RCE

Security

Citrix patches NetScaler CVE-2026-88771: root RCE via log data

Security

F5 patches exploited BIG-IP APM zero-day enabling RCE

Security

PHP2Shell patch leaves session-poisoning LFI-to-RCE open

Palo Alto patches actively exploited PAN-OS management RCE

Citrix patches NetScaler CVE-2026-88771: root RCE via log data

F5 patches exploited BIG-IP APM zero-day enabling RCE

PHP2Shell: patch-verification and hunting plan before disclosure