WordPress CVE-2026-119977: Patch the Upgrade Race RCE
CISA added CVE-2026-119977 to the KEV catalog on 3 November 2026. In WordPress 4.7 through 7.1.3, a full-package core update stages a copy of …
Tag
Php
Magento CVE-2026-48356 (PolyShell): Patch and Hunt
CVE-2026-48356 is the PolyShell file-upload flaw in Adobe Commerce and Magento Open Source. CISA added it to the KEV catalog on October 27, 2026. Here …
PHP session_regenerate_id: Stop Session Fixation Right
Calling session_regenerate_id() at login is the start of PHP session security, not the whole of it. This guide shows the fixation attack strict mode …
php.ini Security Hardening: Production Settings That Matter
PHP's own php.ini-production template still leaves several security settings at permissive defaults, including strict session mode, cookie flags and …
PHP2Shell CVE-2026-109618 and -109619: Patch, Then Hunt
Two PHP core flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution against PHP that serves web requests. CISA added …