Critical CVSS 9.2 CVE in PHP: Have You Finished Upgrading?

Yesterday, PHP disclosed two critical remote code execution (RCE) vulnerabilities. Tracked as CVE-2026-109618 and CVE-2026-109619, they carry a CVSS score of 9.2. According to the official advance ...
Hosted on MSN

WordPress patch became exploit blueprint: CVE-2026-87902 webshells hit 350K sites

Attackers began deploying functional PHP webshells on vulnerable WordPress servers within 48 hours of a critical patch release, exploiting a path-traversal flaw that affects every WordPress version ...