Daily Brief

Securexion Daily Exploit Watch - 22 Oct 2026

Critical PHP memory safety flaws in all supported versions (8.2–8.5) allow unauthenticated remote code execution via out-of-memory and global state corruption. Patch immediately.

Securexion Team

— 1 min read
Share

Critical PHP memory safety flaws in all supported versions (8.2–8.5) allow unauthenticated remote code execution via out-of-memory and global state corruption. Patch immediately.

Critical · CVSS 9.8CVE-2026-109618, CVE-2026-109619

PHP remote code execution via use-after-free in memory management

Two critical vulnerabilities in PHP's out-of-memory handling and global state management leave freed request memory accessible to subsequent requests, allowing remote code execution without authentication or user interaction. All supported PHP versions 8.2 through 8.5 are affected.

What to do: Update PHP immediately to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 depending on your branch; isolate any older instances pending patching.

Read the full analysis →

Securexion is the daily exploit watch by FutureOps InfoTech. Need help patching or checking for compromise? Talk to us.

Read more

Securexion Daily Exploit Watch - 25 Oct 2026

PHP object injection in Prime Mover WordPress plugin allows unauthenticated attackers to execute code when admins perform routine backups; update immediately.

By Securexion Team

Securexion Daily Exploit Watch - 24 Oct 2026

Two actively exploited flaws demand immediate attention: Arista VeloCloud Orchestrator SQL injection (CVSS 9.9) and Collabora Online CODE Server command injection (CVSS 9.2). Patch or isolate these systems now.

By Securexion Team