Share story
Security

PHP2Shell workaround falls short as PHP prepares October 21 fix

PHP2Shell workaround falls short as PHP prepares October 21 fix Image: Primary
GMO Flatt Security has warned that disabling PHP's Session Upload Progress feature is not a complete fix for the two flaws called PHP2Shell, The Hacker News reported. PHP plans to release fixes at 14:00 UTC on October 21 for flaws it rates 9.2 out of 10. Cloudflare says it has seen early exploitation attempts and deployed emergency firewall rules, which it describes as a stopgap. No compromise has been confirmed. PHP has not yet identified affected versions or confirmed a configuration workaround; fixed versions and full details are due with the release.
Sources
The Hacker News
In this story
Cloudflare
Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
Keep reading
Full wire
Security
Security

Cloudflare adds response blocking to its web application firewall

Cloudflare announced generally available firewall capabilities that evaluate web requests alongside application responses and can block a response before it reaches the requester. The capabilities cover all plans, including Free, ...

The Cloudflare Blog
Security Infrastructure
Security Infrastructure

PHP releases fixes for two critical runtime vulnerabilities

PHP has released patches for two critical vulnerabilities that can expose applications to unauthenticated remote code execution and memory disclosure, Google Cloud said October 21. CVE-2026-109618 and CVE-2026-109619 affect PHP 5....

Cloud Blog
Security
Security

Brotli flaw extends beyond Node.js to Python and other HTTP software

A critical Brotli decompression flaw affects Python packages and other HTTP software beyond Node.js, security company Aikido reported on October 23. Crafted compressed data can corrupt memory, leak information, crash a process or ...

aikido.dev