GoPlus Security 🚦 · 2026-10-22 02:29 UTC

🚨 GoPlus Security Alert: Two unauthenticated RCE vulnerabilities in PHP PHP’s official security advisory confirms CVE-2026-109618 and CVE-2026-109619 can both lead to unauthenticated remote code execution. Patched releases are available: 8.2.35, 8.3.36, 8.4.27, 8.5.12. ⚠️ Checks and mitigation steps 1. Know what is actually running. List each entry point, service, node/container, PHP SAPI, the executable path and PHP version used by each running worker, vendor package or image source, config overrides, and public reachability. 2. Upgrade first. Schedule public-facing mod_php first, then other internet-facing PHP services and any internal service that untrusted requests can reach. Move to the patched release for that branch, or a vendor package with a verified backport. Check compatibility and prepare backups and a rollback plan before upgrading. After the upgrade, restart all workers and verify the running PHP version on every node. 3. If you cannot upgrade now, reduce public exposure. Restrict external access. Review upload and input size limits, and request limits.

Loading the story on Tree News…