Overview Recently, NSFOCUS CERT monitored the public disclosure of PHP Remote Code Execution (RCE) vulnerabilities (CVE-2026-109618 / CVE-2026-109619). Due to memory management flaws in PHP Core—where longjmp() handles Out-Of-Memory (OOM) errors leading to failed memory allocations, as well as various global state handling operations—a Use-After-Free (UAF) condition can occur. Unauthenticated...
Tag: WordPress
WordPress Remote Code Execution Vulnerability (CVE-2026-63030/CVE-2026-60137) Notice
Overview Recently, NSFOCUS CERT detected that WordPress issued a security bulletin to fix the WordPress remote code execution vulnerability (CVE-2026-63030/CVE-2026-60137), known as wp2shell; Unauthenticated attackers can bypass authentication through REST API batch requests, use SQL injection to obtain administrator password hashes, and use plug-in installation functions to implant WebShell to...
WordPress plug-in authentication bypass vulnerability Security Alert
Overview Recently, webarx researchers announced two high-risk authentication bypass vulnerabilities in WordPress plug-ins, which allow attackers to log in to an administrator account without a password. (mais…)
