CuraDevOps

tag: Php · 1 items

Act PHP2Shell: critical pre-auth RCE in PHP engine (CVE-2026-109618/19)
2026-10-23 · GitLab Blog · source ↗ #php#security#remote-code-execution
  • Platform/SRE — Act: CVSS 9.2 pre-auth RCE in the PHP engine itself with a vendor-confirmed attack path on Apache/mod_php and no application-level workaround; upgrade every web-serving host or container to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 now (patch released 2026-10-21).
  • CI/CD — Skip
  • Leader — Skip
  • Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, reported by 2 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, reported by 2 collected sources