[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <9f46926f-199a-4ae1-b975-e82b85b72d58@u-bordeaux.fr>
Date: Thu, 22 Oct 2026 10:58:53 +0200
From: Emmanuel Fleury <emmanuel.fleury@...ordeaux.fr>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
On 10/22/26 10:49, Emmanuel Fleury wrote:
>
> Yes, CVE-2026-109618 and CVE-2026-109619 have been found together but seems to
> be two different vulnerabilities (even if they are sharing a lot).
>
> Here is a technical description of the bugs and the finding process:
>
> https://calif.io/php2shell/
Hint: skip the comics part (useless) and go directly to the written part at the end.
Regards
--
Emmanuel Fleury
Univ. de Bordeaux, LaBRI, | Associate Professor,
351, Cours de la Libération | Email: emmanuel.fleury@...ordeaux.fr
33405 Talence Cedex, France | Web: http://www.labri.fr/~fleury
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
