Тревоги 0-day · 2026-10-27T06:37:18

CVE-2019-11043 [RANSOMWARE] - PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

Продукт: PHP FastCGI Process Manager (FPM) · стенд shop-prod (стек: nginx, php)

Действие: Apply updates per vendor instructions.

CVE-2024-4577 [RANSOMWARE] - PHP-CGI OS Command Injection Vulnerability

Продукт: PHP Group PHP · стенд shop-prod (стек: nginx, php)

Действие: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2026-109618 - PHP Memory Corruption Vulnerability

Продукт: PHP Group PHP · стенд shop-prod (стек: nginx, php)

Действие: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

PoC: GetPageSpeed/php2shell-check

PoC: AmanSin001/php2shell-check

PoC: qw3rtyou/php2shell

CVE-2026-109619 - PHP Stale Internal Request-State Vulnerability

Продукт: PHP Group PHP · стенд shop-prod (стек: nginx, php)

Действие: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

PoC: GetPageSpeed/php2shell-check

PoC: AmanSin001/php2shell-check

PoC: jeffschafer/Bigfix-PHP-Vulnerability-Scanner-Content-CVE-2026-109618-CVE-2026-109619