Curated security research, vulnerabilities, advisories and tools for practitioners.

#php

Security coverage tagged php.

1.

php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP

vulnerability | Critical | 2026-10-24 05:43 | github.com | Original ↗ | .md | #rce | #zero-day | #github

2.

php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations

research | Actively exploited | 2026-10-22 10:36 | CVE-2026-109618 | github.com | Original ↗ | .md | #active-exploitation | #rce | #github

3.

[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability

vulnerability | 2026-10-25 14:46 | CVE-2026-111497 | wiz.io | Original ↗ | .md | #rce | #memory-safety | #php

4.

Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster

blog | 2026-10-29 00:00 | aikido.dev | Original ↗ | .md | #php | #aikido | #vdp

5.

PHP2shell: Patch Today, Then Prove It

blog | 2026-10-27 15:44 | xbow.com | Original ↗ | .md | #php | #xbow | #php2shell

6.

Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis

research | 2026-10-25 21:48 | github.com | Original ↗ | .md | #bug-bounty | #rce | #web3

7.

We don't use PHP

blog | 2026-10-27 00:00 | metabase.com | Original ↗ | .md | #php | #metabase

8.

How to patch PHP2Shell with free Aikido Images

blog | 2026-10-26 00:00 | aikido.dev | Original ↗ | .md | #rce | #php | #authentication

9.

Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)

vulnerability | 2026-10-22 00:00 | hunt.io | Original ↗ | .md | #rce | #php | #cve

10.

PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619)

vulnerability | 2026-10-22 00:00 | hacktron.ai | Original ↗ | .md | #ai-security | #rce | #php

11.

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

vulnerability | 2026-10-21 13:59 | wiz.io | Original ↗ | .md | #ai-security | #rce | #php

12.

PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure

blog | 2026-10-23 13:50 | portswigger.net | Original ↗ | .md | #burp-suite | #php | #cve

13.

What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

vulnerability | 2026-10-21 00:00 | aikido.dev | Original ↗ | .md | #rce | #php | #vulnerability

14.

PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619

vulnerability | 2026-10-21 00:00 | netspi.com | Original ↗ | .md | #rce | #php | #pre-auth

15.

PHP2Shell: finding and patching affected PHP

research | 2026-10-22 11:11 | projectdiscovery.io | Original ↗ | .md | #bug-bounty | #vulnerability-research | #php

16.

PHP2Shell: GitLab helps find and remediate critical PHP flaws

blog | 2026-10-22 12:00 | about.gitlab.com | Original ↗ | .md | #gitlab | #remediation | #php

17.

Assetnote Releases php2shell-scanner: High-Fidelity Scanner for CVE-2026-109618 & CVE-2026-109619

tool | 2026-10-22 03:53 | github.com | Original ↗ | .md | #rce | #github | #php

18.

CrowdStrike Protects Customers from Threats Delivered via PHP2Shell

research | 2026-10-21 00:00 | crowdstrike.com | Original ↗ | .md | #rce | #vulnerability-research | #php

19.

Critical PHP Vulnerabilities: What Security Teams Need to Know

blog | 2026-10-21 16:16 | hackerone.com | Original ↗ | .md | #php | #vdp | #hackerone

20.

Chamilo LMS... It's raining 0days, hallelujah, it's raining 0days

vulnerability | 2026-08-31 22:00 | blog.quarkslab.com | Original ↗ | .md | #rce | #zero-day | #vulnerability-research

21.

dinosn/givewp-cve-2026-82222-rce-lab: GiveWP CVE-2026-82222 RCE Docker Lab & PoC

research | 2026-08-30 05:15 | CVE-2026-82222 | github.com | Original ↗ | .md | #rce | #php | #wordpress

22.

CVE-2026-17543 PoC: PHP ext-pgsql SQL injection via backslash breakout

tool | 2026-08-06 17:05 | CVE-2026-17543 | github.com | Original ↗ | .md | #public-poc | #data-exposure | #php

23.

Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird and NULL Pointer Dereference in PDO via pdo_pgsql

research | 2026-07-06 11:06 | swarm.ptsecurity.com | Original ↗ | .md | #vulnerability-research | #memory-safety | #denial-of-service

24.

Packagist is now protected by Aikido Intel and other updates to the PHP registry

blog | 2026-06-26 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #threat-intelligence | #malware

25.

Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer

incident | 2026-05-23 00:00 | aikido.dev | Original ↗ | .md | #cloud | #supply-chain | #credential-theft

26.

Hack the Elephant One Bite at a Time: JPEG-Related Memory-Safety Bugs in PHP

research | 2026-05-15 09:09 | swarm.ptsecurity.com | Original ↗ | .md | #vulnerability-research | #memory-safety | #php

27.

PHP 8.5.5: var_destroy __destruct Reentrancy Heap UAF and Exploitation

vulnerability | High | 2026-05-02 16:39 | github.com | Original ↗ | .md | #rce | #php | #exploitation

28.

Finding and Exploiting a 21-Year-Old Vulnerability in PHP

research | 2026-05-01 00:00 | calif.io | Original ↗ | .md | #vulnerability-research | #php | #exploitation

29.

The Fragile Lock: Novel Bypasses For SAML Authentication

research | 2026-01-21 10:34 | portswigger.net | Original ↗ | .md | #appsec | #ruby | #authentication-bypass

30.

Security review of PHP documentation

research | 2025-09-21 22:00 | blog.quarkslab.com | Original ↗ | .md | #php | #secure-coding | #documentation