Netcrook
#PHP
One HTTPS Request, One Crashing Worker: The PHP Bug That Turns Availability Into a Weak Point
CVE-2026-12184 shows how an ordinary outbound fetch path can become a denial-of-service trigger for PHP applications that rely on proxies and PHP-FPM.
PHP Closes Two Crash Paths Hidden in Its Network and Crypto Core
A high-severity TLS stream flaw and a heap-corruption bug in PHP’s OpenSSL extension now push operators to verify patched builds across supported branches.
Cacti’s Graph View Became a Quiet Gateway for Pre-Auth SQL Injection
A monitoring feature built for visibility can become a remote attack surface when user input reaches SQL logic before authentication checks.
One Plugin, One Cleanup Routine, and a Critical Path to WordPress File Loss
A severe flaw in Avada Builder shows how a convenience feature can turn into a server-integrity problem when unauthenticated input reaches file-handling code.
When a Joomla Add-On Turns Into a Code-Execution Shortcut
CVE-2026-48907 shows how an access-control bug in a CMS extension can move from profile management to PHP web shell risk in one step.
When a Premium WordPress Plugin Becomes the Trojan Horse
A reported backdoor in paid ShapedPlugin add-ons shows how a trusted update path can turn routine maintenance into a supply-chain risk.
When an Editor Plugin Becomes an Execution Path
A critical Joomla extension flaw added to CISA’s exploited-vulnerability list shows how a quiet access-control break can turn a publishing tool into a server-side risk.
When a PHP Foothold Turns Into Server-Grade Risk
Exploited weaknesses tied to Joomla and LiteSpeed show how quickly a web application issue can grow into a shared-hosting boundary problem.
CodeIgniter Alert Raises the Stakes for PHP Teams: A Critical Flaw Could Turn Web Apps into Shells
A new critical vulnerability in the CodeIgniter PHP framework is a reminder that a shared component can become an urgent patch problem for every application built on it.
When a Content Plugin Becomes a Server Risk
A Joomla editor extension has entered active exploitation, showing how an ordinary admin tool can become a path to remote code execution when access control slips.
CodeIgniter4 Upload Validation Bug Put Web Apps on a Razor’s Edge
A critical flaw in CodeIgniter4’s file handling shows how a small mismatch between validation logic and deployment settings can turn an ordinary upload feature into a route to remote code execution.
Public PHP Setup Page Put a Malware Backend in the Open
A leftover installation page reportedly turned a live malware distribution platform into an externally reachable administration target, showing how a basic deployment mistake can collapse operational secrecy.
The Hidden Door in a Malware Panel: When a Setup Page Became the Weakest Link
An exposed PHP installer page reportedly handed administrative access to a researcher, showing how a single leftover control surface can matter more than the malware it was built to serve.
When a Form Plugin Becomes a Code Runner: The Everest Forms RCE Risk
A vulnerability linked to Everest Forms has been tied to remote code execution on WordPress sites, and the technical record points to a classic danger zone: user input reaching executable PHP.
WordPress Forms Turn Dangerous as a Calculation Feature Opens the Door to Server Takeover
A critical flaw in Everest Forms Pro shows how a seemingly harmless form calculator can become a direct path to PHP execution on vulnerable WordPress sites.
A Cache Booster, a Serialization Trap, and a Magento Code-Execution Risk
A flaw in Mirasvit’s Full Page Cache Warmer extension shows how a performance add-on can become a security-sensitive entry point when untrusted PHP objects reach deserialization code.
Laravel Patch Closes a Mail Trust Gap Hidden in Symfony Components
A security update in the Laravel stack spotlights a narrow but dangerous boundary: when web apps hand mail delivery off to shared components, a parsing flaw can turn into a trust problem.
When a Dev Branch Turns Toxic: The Quiet Supply-Chain Trap Inside a PHP Package
A legitimate Laravel package surfaced with hidden obfuscated JavaScript, showing how development refs and package trust can become a developer-side attack surface.
When Tags Turn Toxic: The Laravel-Lang Poisoning Case and the Hidden Risk in CI
Malicious package tags published in a short window turned a routine dependency path into a potential route for stealing build-time secrets.
How a Trusted PHP Package Path Became a Backdoor Delivery Route
A supply-chain compromise around Laravel-Lang shows how release metadata, not just source code, can become the point where trust breaks.