NewsThe Hacker News
PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
Linked advisories
More on Unpatched
Other advisories
- Highpwn_watch:tailscale-tailworm-ssh-forwarding-privescTailworm: researcher drops 11 unpatched Tailscale and headscale flaws, Tailscale SSH forwarding gives root on other nodes
- Criticalpwn_watch:linux-kernel-zdi-reports-leaked-to-lkmlLinux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)
- HighCVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
- HighCVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
- Not ratedosv:CVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
- CriticalCVE-2025-59851HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, whic…
- Not ratedosv:CVE-2026-35667OpenClaw < 2026.3.24 - Improper Process Termination via Unpatched killProcessTree in shell-utils.ts
- Not ratedosv:ECHO-ddb8-c818-edcaVulnerable code is not present in libraw 0.21.4 (the version shipped in Debian trixie). The CVE describes a heap out-of-bounds write in HuffTable::initval (src/decompressors/losslessjpeg.cpp), reachable via LibRaw::sony_ycbcr_load_raw -> LibRaw_LjpegDecompressor::initialize -> HuffTable::initval. None of those symbols exist in 0.21.4: the src/decompressors/ directory, the LibRaw_LjpegDecompressor class, and the sony_ycbcr_load_raw entry point were all introduced together in libraw 0.22.0. Empirically confirmed by running the public PoC from https://github.com/biniamf/pocs/tree/main/libraw_lljpeg against an ASan build of unpatched libraw 0.21.4: the file is rejected at open with "Unsupported file format or not RAW file"; the same PoC reproduces the heap-buffer-overflow in 0.22.0 with the stack trace from the Talos report.
Other news entries
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other ServersNewsThe Hacker News
- PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatchedNewsThe Register — Security
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertNewsThe Hacker News
- PSA: Patch your Plex media server before someone hacks itNewsArs Technica — Security
- Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on RoutersNewsThe Hacker News
- EU Grocers Pay a Steep Price for Unpatched Fridge FirmwareNewsDark Reading
- Unpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoNewsBleepingComputer
- Unpatched AhsayCBS Vulnerabilities Exploited in the WildNewsSecurityWeek
Source: https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html
ID