AdvisoriesToolsStatsChecklistSubmitGet the email
← All tools
Generated stack · The PHP Group

PHP

Server-side runtime behind WordPress, Laravel and most shared hosting.

1Advisories
1critical
0high
0medium
2026-10-21Latest
Timeline · advisories per quarter
12026 Q4
Named in sources

Reported for PHP

01. criticalCode executionNew this weekphp2shell (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code execution in PHP itselfTwo bugs in how the PHP runtime cleans up memory after a request ends abnormally can let an unauthenticated HTTP request run code as the web server's PHP worker. They affect every PHP install that serves web requests (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed). PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them, and Cloudflare's WAF blocks known exploits by default, including on the Free plan. PHP Replit 2026-10-21
The weekly email

One email a week. Only what changed.

New advisories, CVEs and fixes for Lovable, Bolt, v0, Replit, Base44 and Cursor apps. No roundups of things you already read.

Free. The list is new, so the first issues go out once there are readers. Unsubscribe from any email in one click. We never sell or share addresses.