https://shellproof.dev/ PHP security releases and the advisories Shellproof checks for, from php.net data. en Thu, 22 Oct 2026 04:58:35 GMT https://shellproof.dev/advisories/php2shell/ CVE-2026-109619 Wed, 21 Oct 2026 00:00:00 GMT Request-owned state (error, session, object and extension state) can stay published in persistent worker globals after the request heap has been freed. If a later request on the same worker touches that state before normal initialisation resets it, the result is a use-after-free. Confirmed impact: unauthenticated memory disclosure and remote code execution as the web worker account. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12. Exploited in the wild. https://shellproof.dev/advisories/php2shell/ CVE-2026-109618 Wed, 21 Oct 2026 00:00:00 GMT PHP exits with longjmp() when it runs out of memory. Request memory can be reachable before it is fully initialised, so an out-of-memory error inside that window leaves invalid state that request shutdown later processes as valid. Multipart request parsing, which runs before any application code, can trigger it. Confirmed impact: unauthenticated remote code execution as the web worker account. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12. Exploited in the wild. https://www.php.net/ChangeLog-8.php#8.5.12 php-8.5.12 Wed, 21 Oct 2026 00:00:00 GMT Fixes CVE-2026-109618, CVE-2026-109619. https://www.php.net/ChangeLog-8.php#8.4.27 php-8.4.27 Wed, 21 Oct 2026 00:00:00 GMT Fixes CVE-2026-109618, CVE-2026-109619. https://www.php.net/ChangeLog-8.php#8.3.36 php-8.3.36 Wed, 21 Oct 2026 00:00:00 GMT Fixes CVE-2026-109618, CVE-2026-109619. https://www.php.net/ChangeLog-8.php#8.2.35 php-8.2.35 Wed, 21 Oct 2026 00:00:00 GMT Fixes CVE-2026-109618, CVE-2026-109619. https://www.php.net/ChangeLog-8.php#8.5.11 php-8.5.11 Thu, 24 Sep 2026 00:00:00 GMT Fixes CVE-2025-1218, CVE-2025-14181, CVE-2026-17545, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682. https://www.php.net/ChangeLog-8.php#8.4.26 php-8.4.26 Thu, 24 Sep 2026 00:00:00 GMT Fixes CVE-2025-1218, CVE-2025-14181, CVE-2026-17545, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682. https://www.php.net/ChangeLog-8.php#8.3.35 php-8.3.35 Thu, 24 Sep 2026 00:00:00 GMT Fixes CVE-2025-1218, CVE-2025-14181, CVE-2026-17545, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682. https://www.php.net/ChangeLog-8.php#8.2.34 php-8.2.34 Thu, 24 Sep 2026 00:00:00 GMT Fixes CVE-2025-1218, CVE-2025-14181, CVE-2026-17545, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682. https://www.php.net/ChangeLog-8.php#8.5.9 php-8.5.9 Thu, 30 Jul 2026 00:00:00 GMT Fixes CVE-2026-17543, CVE-2026-17544, CVE-2026-7260, CVE-2026-9672. https://www.php.net/ChangeLog-8.php#8.4.24 php-8.4.24 Thu, 30 Jul 2026 00:00:00 GMT Fixes CVE-2026-17543, CVE-2026-17544, CVE-2026-7260, CVE-2026-9672. https://www.php.net/ChangeLog-8.php#8.3.33 php-8.3.33 Thu, 30 Jul 2026 00:00:00 GMT Fixes CVE-2026-17543, CVE-2026-7260, CVE-2026-9672. https://www.php.net/ChangeLog-8.php#8.2.33 php-8.2.33 Thu, 30 Jul 2026 00:00:00 GMT Fixes CVE-2026-17543, CVE-2026-7260, CVE-2026-9672. https://www.php.net/ChangeLog-8.php#8.5.8 php-8.5.8 Thu, 02 Jul 2026 00:00:00 GMT Fixes CVE-2026-14355. https://www.php.net/ChangeLog-8.php#8.4.23 php-8.4.23 Thu, 02 Jul 2026 00:00:00 GMT Fixes CVE-2026-14355. https://www.php.net/ChangeLog-8.php#8.3.32 php-8.3.32 Thu, 02 Jul 2026 00:00:00 GMT Fixes CVE-2026-12184, CVE-2026-14355. https://www.php.net/ChangeLog-8.php#8.2.32 php-8.2.32 Thu, 02 Jul 2026 00:00:00 GMT Fixes CVE-2026-14355. https://www.php.net/ChangeLog-8.php#8.5.7 php-8.5.7 Thu, 04 Jun 2026 00:00:00 GMT Fixes CVE-2026-44927, CVE-2026-44928. https://www.php.net/ChangeLog-8.php#8.5.6 php-8.5.6 Thu, 07 May 2026 00:00:00 GMT Fixes CVE-2025-14179, CVE-2026-12184, CVE-2026-42371, CVE-2026-6104, CVE-2026-6722, CVE-2026-6735, CVE-2026-7258, CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7263, CVE-2026-7568. https://www.php.net/ChangeLog-8.php#8.4.21 php-8.4.21 Thu, 07 May 2026 00:00:00 GMT Fixes CVE-2025-14179, CVE-2026-12184, CVE-2026-6104, CVE-2026-6722, CVE-2026-6735, CVE-2026-7258, CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7263, CVE-2026-7568. https://www.php.net/ChangeLog-8.php#8.3.31 php-8.3.31 Thu, 07 May 2026 00:00:00 GMT Fixes CVE-2025-14179, CVE-2026-6722, CVE-2026-6735, CVE-2026-7258, CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568. https://www.php.net/ChangeLog-8.php#8.2.31 php-8.2.31 Thu, 07 May 2026 00:00:00 GMT Fixes CVE-2025-14179, CVE-2026-6722, CVE-2026-6735, CVE-2026-7258, CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568. https://www.php.net/ChangeLog-8.php#8.5.1 php-8.5.1 Thu, 18 Dec 2025 00:00:00 GMT Fixes CVE-2025-14177, CVE-2025-14178, CVE-2025-14180, CVE-2025-67899. https://www.php.net/ChangeLog-8.php#8.4.16 php-8.4.16 Thu, 18 Dec 2025 00:00:00 GMT Fixes CVE-2025-14177, CVE-2025-14178, CVE-2025-14180. https://www.php.net/ChangeLog-8.php#8.3.29 php-8.3.29 Thu, 18 Dec 2025 00:00:00 GMT Fixes CVE-2025-14177, CVE-2025-14178, CVE-2025-14180. https://www.php.net/ChangeLog-8.php#8.2.30 php-8.2.30 Thu, 18 Dec 2025 00:00:00 GMT Fixes CVE-2025-14177, CVE-2025-14178, CVE-2025-14180. https://www.php.net/ChangeLog-8.php#8.1.34 php-8.1.34 Thu, 18 Dec 2025 00:00:00 GMT Fixes CVE-2025-14177, CVE-2025-14178, CVE-2025-14180. https://www.php.net/ChangeLog-8.php#8.4.10 php-8.4.10 Thu, 03 Jul 2025 00:00:00 GMT Fixes CVE-2025-1220, CVE-2025-1735, CVE-2025-6491. https://www.php.net/ChangeLog-8.php#8.3.23 php-8.3.23 Thu, 03 Jul 2025 00:00:00 GMT Fixes CVE-2025-1220, CVE-2025-1735, CVE-2025-6491.