{"title":"PHP advisories","description":"PHP interpreter and PHP application advisories: WordPress, Drupal, Joomla and anything running on PHP-FPM or mod_php.","home":"https://vulnpocalypse.dev/feeds/","items":[{"id":"https://vulnpocalypse.dev/advisories/ncsc-warns-ai-powered-ransomware-is-highly-likely-to-hit-uk-critical-infrastruct/","title":"NCSC warns AI-powered ransomware is highly likely to hit UK critical infrastructure by 2028","url":"https://vulnpocalypse.dev/advisories/ncsc-warns-ai-powered-ransomware-is-highly-likely-to-hit-uk-critical-infrastruct/","date":"2026-11-11","summary":"The UK NCSC says AI-powered malware is highly likely to feature in ransomware attacks on critical infrastructure by 2028, so patch and fix the basics now.","tags":["ai-tools","ai-tools","enterprise","php"]},{"id":"https://vulnpocalypse.dev/advisories/italy-intel471-reports-outlier-rates-of-vulnerability-based-initial-access/","title":"Italy: Intel471 reports outlier rates of vulnerability-based initial access","url":"https://vulnpocalypse.dev/advisories/italy-intel471-reports-outlier-rates-of-vulnerability-based-initial-access/","date":"2026-11-11","summary":"Dark Reading reports Intel471 data showing Italian firms are outliers in sold access via vulnerabilities; patch exposed web systems and retire old PHP.","tags":["exploited","web","php","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/wordpress-7-1-4-core-update-race-rce/","title":"WordPress 7.1.4 core update race (GHSA-4w3m-c66w-69mg): unauthenticated code execution during upgrades, now under attack","url":"https://vulnpocalypse.dev/advisories/wordpress-7-1-4-core-update-race-rce/","date":"2026-11-11","summary":"Full core updates in WordPress 4.7 to 7.1.3 open a brief unauthenticated RCE window. Update to 7.1.4 or your branch's fix and block wp-content/upgrade.","tags":["exploited","php","web"]},{"id":"https://vulnpocalypse.dev/advisories/panos-php2shell-cve-2026-109618/","title":"Palo Alto Networks PAN-OS: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploited through internet-exposed management interfaces","url":"https://vulnpocalypse.dev/advisories/panos-php2shell-cve-2026-109618/","date":"2026-11-11","summary":"PHP2Shell is exploited against PAN-OS and Panorama with management exposed to the internet. Apply your train's hotfix and take management off the internet.","tags":["exploited","network-edge","php","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/freepbx-cyble-reports-inj3ctor3-malware-now-steals-sip-trunk-credentials/","title":"FreePBX: Cyble reports INJ3CTOR3 malware now steals SIP trunk credentials","url":"https://vulnpocalypse.dev/advisories/freepbx-cyble-reports-inj3ctor3-malware-now-steals-sip-trunk-credentials/","date":"2026-11-11","summary":"Cyble reports INJ3CTOR3 malware now exfiltrates FreePBX SIP trunk credentials, so isolate and clean hosts before rotating any secrets.","tags":["exploited","php","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/","title":"Drupal Commerce Core CVE-2026-118539: highly critical access bypass exploited against online stores","url":"https://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/","date":"2026-11-11","summary":"An exploited access bypass in Drupal Commerce Core can cost store owners money. Update to Commerce 3.3.13 or 8.x-2.41 and audit recent orders.","tags":["exploited","php","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/gmo-internet-and-park24-disclose-cyberattacks-and-pay-users-report-says/","title":"GMO Internet and Park24 disclose cyberattacks and pay users, report says","url":"https://vulnpocalypse.dev/advisories/gmo-internet-and-park24-disclose-cyberattacks-and-pay-users-report-says/","date":"2026-11-11","summary":"GMO Internet Group and Park24 say they will compensate users after cyberattacks, Indian Express reports; customers should follow company notices.","tags":["breach","enterprise","web","php"]},{"id":"https://vulnpocalypse.dev/advisories/php2shell-cve-2026-109618-109619/","title":"PHP2Shell (CVE-2026-109618, CVE-2026-109619): patch the PHP engine, not just your app","url":"https://vulnpocalypse.dev/advisories/php2shell-cve-2026-109618-109619/","date":"2026-11-11","summary":"Two PHP engine flaws allow unauthenticated code execution on WordPress, Drupal and Joomla. Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.","tags":["exploited","php"]},{"id":"https://vulnpocalypse.dev/advisories/reversinglabs-reports-ai-linked-malware-signals-rising-no-clear-attack-surge/","title":"ReversingLabs reports AI-linked malware signals rising, no clear attack surge","url":"https://vulnpocalypse.dev/advisories/reversinglabs-reports-ai-linked-malware-signals-rising-no-clear-attack-surge/","date":"2026-11-10","summary":"ReversingLabs says LLM API references in malicious files are rising but no AI attack surge is shown; review exposure to PHP2Shell CVEs.","tags":["ai-tools","ai-tools","php","vuln-data"]},{"id":"https://vulnpocalypse.dev/advisories/cert-polska-reports-four-widzialnicms-flaws-fixed-in-25/","title":"CERT Polska reports four WidzialniCMS flaws, fixed in 2.5","url":"https://vulnpocalypse.dev/advisories/cert-polska-reports-four-widzialnicms-flaws-fixed-in-25/","date":"2026-11-09","summary":"CERT Polska reports four vulnerabilities in WidzialniCMS before 2.5, including unauthenticated file upload; upgrade to version 2.5.","tags":["exploited","web","php"]},{"id":"https://vulnpocalypse.dev/advisories/stylesmuggler-magento-psk-rat/","title":"StyleSmuggler attacks hit Magento and Adobe Commerce stores and drop the PSK Agent Go RAT","url":"https://vulnpocalypse.dev/advisories/stylesmuggler-magento-psk-rat/","date":"2026-11-09","summary":"A coordinated campaign abused the Magento StyleSmuggler flaw (CVE-2026-75650) to run code on Adobe Commerce stores and install the PSK Agent Go RAT.","tags":["breach","web","enterprise","php"]},{"id":"https://vulnpocalypse.dev/advisories/suspected-chinese-actor-chains-php2shell-and-fragnesia-to-root-25-pan-os-servers/","title":"Suspected Chinese actor chains PHP2Shell and Fragnesia to root 25 PAN-OS servers","url":"https://vulnpocalypse.dev/advisories/suspected-chinese-actor-chains-php2shell-and-fragnesia-to-root-25-pan-os-servers/","date":"2026-11-09","summary":"A suspected China-nexus actor chained PHP2Shell with the Fragnesia kernel flaw to root 25 Palo Alto PAN-OS servers, including three in a US","tags":["ai-tools","php","network-edge","enterprise","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/rapid7-reports-new-metasploit-modules-for-citrix-netscaler-flowise-spip/","title":"Rapid7 reports new Metasploit modules for Citrix NetScaler, Flowise, SPIP","url":"https://vulnpocalypse.dev/advisories/rapid7-reports-new-metasploit-modules-for-citrix-netscaler-flowise-spip/","date":"2026-11-06","summary":"Rapid7 says new Metasploit modules target Citrix NetScaler, Flowise, SPIP and OpenBullet2 flaws, so check exposure and apply vendor fixes.","tags":["ai-tools","network-edge","ci-cd","ai-tools","php","open-source","web"]},{"id":"https://vulnpocalypse.dev/advisories/nikkei-reports-japan-to-seek-vulnerability-data-from-us-ai-firms/","title":"Nikkei reports Japan to seek vulnerability data from US AI firms","url":"https://vulnpocalypse.dev/advisories/nikkei-reports-japan-to-seek-vulnerability-data-from-us-ai-firms/","date":"2026-11-06","summary":"Nikkei reports Japan wants early access to undisclosed vulnerability data from US AI firms; PHP CVE details are not confirmed, so check PHP patches.","tags":["ai-tools","php","ai-tools","vuln-data"]},{"id":"https://vulnpocalypse.dev/advisories/help-net-security-reports-php2shell-exploitation-in-november-forecast/","title":"Help Net Security reports PHP2Shell exploitation in November forecast","url":"https://vulnpocalypse.dev/advisories/help-net-security-reports-php2shell-exploitation-in-november-forecast/","date":"2026-11-06","summary":"Help Net Security reports in-the-wild exploitation of PHP2Shell PHP flaws; update the PHP runtime and restart the web server.","tags":["exploited","php","web","enterprise","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/wordfence-reports-weekly-wordpress-vulnerability-roundup-for-oct-26-to-nov-1/","title":"Wordfence reports weekly WordPress vulnerability roundup for Oct 26 to Nov 1","url":"https://vulnpocalypse.dev/advisories/wordfence-reports-weekly-wordpress-vulnerability-roundup-for-oct-26-to-nov-1/","date":"2026-11-05","summary":"Wordfence reports a weekly WordPress vulnerability roundup for October 26 to November 1, 2026, so check it against your installed WordPress components.","tags":["exploited","php","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/","title":"ARTEX Docker image backdoored, researcher says; CERT-In flags Crafty Falcon","url":"https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/","date":"2026-11-05","summary":"A researcher reports a backdoored ARTEX Docker image giving unauthenticated root shells; remove any ARTEX install built from unvetted images.","tags":["supply-chain","ai-tools","open-source","cloud","crypto","php","nodejs","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/impart-says-its-ai-harness-builds-virtual-patches-outside-traffic-path/","title":"Impart says its AI harness builds virtual patches outside traffic path","url":"https://vulnpocalypse.dev/advisories/impart-says-its-ai-harness-builds-virtual-patches-outside-traffic-path/","date":"2026-11-04","summary":"Help Net Security reports Impart claims its new AI harness ships tested virtual patches fast; these are vendor claims, so verify them independently.","tags":["ai-tools","nodejs","php","web","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/idnsec-reports-42-openemr-advisories-fixed-in-850-patch-now/","title":"IDNSEC reports 42 OpenEMR advisories fixed in 8.5.0, patch now","url":"https://vulnpocalypse.dev/advisories/idnsec-reports-42-openemr-advisories-fixed-in-850-patch-now/","date":"2026-11-04","summary":"IDNSEC reports 42 OpenEMR advisories credited to its research, fixed in 8.5.0; self-hosted operators should upgrade to 8.5.0.","tags":["exploited","php","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/cryptopayment-gateway-flaw-exploited/","title":"Unpatched CryptoPayment Gateway WordPress plugin exploited: unauthenticated attackers can read wallet credentials in cleartext","url":"https://vulnpocalypse.dev/advisories/cryptopayment-gateway-flaw-exploited/","date":"2026-11-04","summary":"CVE-2026-81648, a CVSS 10.0 missing authorization flaw in the CryptoPayment Gateway WordPress plugin, is being exploited and has no fix.","tags":["exploited","php","web","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/cloudflare-launches-zero-wire-a-public-hub-for-triaging-critical-internet-vulner/","title":"Cloudflare launches Zero Wire, a public hub for triaging critical Internet vulnerabilities","url":"https://vulnpocalypse.dev/advisories/cloudflare-launches-zero-wire-a-public-hub-for-triaging-critical-internet-vulner/","date":"2026-11-04","summary":"Cloudflare launched Zero Wire on Radar, a public feed of briefings on critical vulnerabilities, with exploitation evidence kept separate from severity.","tags":["ecosystem","vuln-data","web","php","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/palo-alto-networks-ceo-says-ai-is-driving-faster-cyberattacks-etciso-reports/","title":"Palo Alto Networks CEO says AI is driving faster cyberattacks, ETCISO reports","url":"https://vulnpocalypse.dev/advisories/palo-alto-networks-ceo-says-ai-is-driving-faster-cyberattacks-etciso-reports/","date":"2026-11-03","summary":"Palo Alto Networks CEO says AI is speeding up cyberattacks, ETCISO reports; test exposed infrastructure for known flaws and misconfigurations.","tags":["ai-tools","ai-tools","php","enterprise","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/","title":"Hacktober 2026: PHP2Shell, Node.js and LiteLLM fixes, Binance probe","url":"https://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/","date":"2026-11-02","summary":"October 2026 brought unrelated incidents, including PHP2Shell, Node.js patches and a malicious LiteLLM 1.107.0; update runtimes and review credentials.","tags":["ai-tools","php","nodejs","pypi","npm","github-actions","ai-tools","crypto","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/magento-polyshell-cve-2026-48356/","title":"Magento and Adobe Commerce PolyShell (CVE-2026-48356): file upload flaw added to CISA KEV after hundreds of store breaches","url":"https://vulnpocalypse.dev/advisories/magento-polyshell-cve-2026-48356/","date":"2026-11-02","summary":"PolyShell lets attackers upload code to Magento and Adobe Commerce stores and is in CISA KEV. Install the -2026-jul builds, then check CMS blocks and pub/media.","tags":["exploited","php","web"]},{"id":"https://vulnpocalypse.dev/advisories/php-session-upload-progress-cve-2026-115560/","title":"PHP session upload progress RCE vector (CVE-2026-115560) with no fix yet, plus Windows builds rebuilt for Brotli","url":"https://vulnpocalypse.dev/advisories/php-session-upload-progress-cve-2026-115560/","date":"2026-11-02","summary":"A new PHP session upload progress RCE needs an unusual setup and has no fix yet. Set session.upload_progress.enabled=0; Windows users install the -1 builds.","tags":["exploited","php","web"]},{"id":"https://vulnpocalypse.dev/advisories/collabora-code-nextcloud-cve-2026-110447/","title":"Collabora Built-in CODE Server for Nextcloud (CVE-2026-110447): OS command injection exploited to plant web shells","url":"https://vulnpocalypse.dev/advisories/collabora-code-nextcloud-cve-2026-110447/","date":"2026-11-02","summary":"An unauthenticated command injection in Nextcloud's Built-in CODE Server app is used to drop web shells. Update richdocumentscode to 26.4.303 or remove it.","tags":["exploited","php","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/updraftcentral-key-compromise/","title":"UpdraftCentral key compromise: stolen TeamUpdraft keys used to push 99 backdoor plugins to WordPress sites running UpdraftPlus","url":"https://vulnpocalypse.dev/advisories/updraftcentral-key-compromise/","date":"2026-11-02","summary":"Stolen UpdraftCentral keys let attackers install backdoor plugins on UpdraftPlus sites. Update to 1.26.13 or 2.26.13, delete keys, then hunt for the backdoor.","tags":["supply-chain","php","web"]},{"id":"https://vulnpocalypse.dev/advisories/rank-math-pro-backdoor/","title":"Rank Math PRO 3.0.123 (CVE-2026-111862): vendor download and update channel served a self-restoring WordPress backdoor","url":"https://vulnpocalypse.dev/advisories/rank-math-pro-backdoor/","date":"2026-11-02","summary":"Rank Math PRO 3.0.123 copies fetched 15-16 Oct 2026 held a self-restoring backdoor. Delete the plugin folder, clear three options, install 3.0.124.","tags":["supply-chain","php","web"]},{"id":"https://vulnpocalypse.dev/advisories/pytorch-lightning-pypi-compromise/","title":"PyTorch Lightning 2.6.2 and 2.6.3 on PyPI ran a Bun-based credential stealer on import; intercom-client 7.0.4 followed","url":"https://vulnpocalypse.dev/advisories/pytorch-lightning-pypi-compromise/","date":"2026-11-02","summary":"lightning 2.6.2 and 2.6.3 on PyPI stole credentials on import and spread via GitHub and npm. Check installs, rotate secrets, use 2.6.1 or 2.6.4+.","tags":["supply-chain","pypi","npm","php","ai-tools","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/bithumb-daishin-securities-and-mirae-asset-report-hacks-in-new-south-korean-fina/","title":"Bithumb, Daishin Securities and Mirae Asset report hacks in new South Korean financial breach wave","url":"https://vulnpocalypse.dev/advisories/bithumb-daishin-securities-and-mirae-asset-report-hacks-in-new-south-korean-fina/","date":"2026-10-28","summary":"Bithumb, Daishin Securities and Mirae Asset reported hacking incidents on Oct 28, 2026, with Daishin confirming exposed customer contact data; root cause is","tags":["breach","crypto","enterprise","web","php"]},{"id":"https://vulnpocalypse.dev/advisories/wordfence-reports-wordpress-vulnerabilities-for-october-12-to-18-2026/","title":"Wordfence reports WordPress vulnerabilities for October 12 to 18, 2026","url":"https://vulnpocalypse.dev/advisories/wordfence-reports-wordpress-vulnerabilities-for-october-12-to-18-2026/","date":"2026-10-23","summary":"Wordfence says it published its weekly WordPress vulnerability report for October 12 to 18, 2026, so check it against the WordPress components you run.","tags":["exploited","php","web","open-source"]}]}