Upgrade to Composer 2.11.0 or 2.2.31 to fix two Composer vulnerabilities: path traversal GHSA-c968-33g3-wh7p and token leak GHSA-fm2w-xgf2-f9fh.

Related Posts:

• Linux Kernel CVE-2026-98432 Flaw Enables Remote Root
• Progress Patches 10.0 CVSS WS_FTP Server Flaw CVE-2026-84295 and 14 Other Bugs
• WordPress Core Vulnerability Exploited in the Wild

The post Composer 2.11.0 and 2.2.31 Patch Path Traversal and Token Leak Vulnerabilities appeared first on Daily CyberSecurity.

CISA adds PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to the CISA KEV catalog after confirmed RCE and suspected DPRK-linked scanning.

Related Posts:

• Apple iOS 27.2 Update Fixes 160 Security Flaws
• Apple Backports Fix for Exploited CoreGraphics Zero-Day CVE-2026-86950 to Older iPhones
• HashiCorp Patches Critical 9.9 CVSS Consul-k8s Authorization Bypass Vulnerability (CVE-2026-110720)

The post CISA Adds PHP2Shell to KEV as Confirmed RCE Attacks and Suspected DPRK Scanning Surface appeared first on Daily CyberSecurity.

OpenMage fixes 34 OpenMage vulnerabilities in Magento LTS, including a critical CSRF flaw that hands out API tokens. Upgrade to 20.19.0 or 20.18.2.

Related Posts:

• Apple iOS 27.2 Update Fixes 160 Security Flaws
• CISA Adds PHP2Shell to KEV as Confirmed RCE Attacks and Suspected DPRK Scanning Surface
• Apple Backports Fix for Exploited CoreGraphics Zero-Day CVE-2026-86950 to Older iPhones

The post OpenMage Fixes 34 Flaws in Magento LTS, Including Critical OAuth CSRF appeared first on Daily CyberSecurity.

PHP warns of CVE-2026-115560, a PHP session vulnerability that follows PHP2Shell. Disable session.upload_progress until the next bugfix release.

Related Posts:

• Palo Alto Networks Confirms PHP2Shell Flaws Affect PAN-OS and Panorama
• LiteSpeed Cache Flaws Expose 7 Million WordPress Sites to Stored XSS
• Oracle Issues Java Security Alert to Distrust Compromised eMudhra Certificates

The post PHP Warns of New Session Upload Progress Flaw CVE-2026-115560, Urges Mitigation appeared first on Daily CyberSecurity.

A public PoC is out for CVE-2026-114509, a Laravel authentication bypass in TokenGuard enabling account takeover. Upgrade to 12.68.0 or 13.29.0.

Related Posts:

• Palo Alto Networks Confirms PHP2Shell Flaws Affect PAN-OS and Panorama
• PHP Warns of New Session Upload Progress Flaw CVE-2026-115560, Urges Mitigation
• LiteSpeed Cache Flaws Expose 7 Million WordPress Sites to Stored XSS

The post Laravel Authentication Bypass PoC Released for Critical TokenGuard Flaw CVE-2026-114509 appeared first on Daily CyberSecurity.

PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now.

Related Posts:

• cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers
• QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline
• Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts

The post PHP2Shell Exploited in the Wild as PoC Exploits and Full Details Go Public appeared first on Daily CyberSecurity.

Cloudflare reports early attacks on two critical PHP flaws ahead of the PHP security release fixing remote code execution bugs CVE-2026-109618.

Related Posts:

• Atlassian Patches 176 Flaws in Jira, Confluence and Other Data Center Products
• Oracle E-Business Suite Flaw CVE-2026-101809 Scores CVSS 10.0
• Apache CouchDB 3.5.3 Fixes Six Flaws as Retired Apache Cocoon Gets Four Unpatched Bugs

The post PHP Prepares Emergency Fix as Cloudflare Reports Early Attacks on Critical Flaws appeared first on Daily CyberSecurity.

The PHP project patched critical PHP vulnerabilities across multiple branches. Update now to resolve these PHP vulnerabilities and secure your web servers.

Related Posts:

• Critical ViewSonic vCast Vulnerabilities Enable Device Takeover
• MongoDB Driver Vulnerabilities Fixed Across Ecosystem
• High-Severity Apache Qpid Broker-J Vulnerabilities Fixed

The post High-Severity PHP Vulnerabilities Patched Across Multiple Branches appeared first on Daily CyberSecurity.