On October 20, 2026, the PHP security team issued an advance security advisory regarding two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting core PHP source code. Both vulnerabilities carry a critical-severity CVSS v4.0 score of 9.2 and could potentially allow unauthenticated remote code execution (RCE) on affected servers.

The official patched PHP releases are now available. Given the potential impact across web applications, content management systems (CMS), and microservices running PHP, Detectify recommends immediate asset discovery and patching.

What is the risk?

While specific technical implementation details remain under embargo, early advisories indicate:

• Unauthenticated Remote Code Execution (RCE): Both vulnerabilities allow remote attackers to execute arbitrary code on the underlying host operating system without prior authentication.
• Broad impact: Security advisories highlight that these flaws potentially affect all supported release branches and legacy environments (including PHP 5.x through 8.x).
• High attractiveness to attackers: Because PHP powers a vast majority of the public web, including platforms like WordPress, Drupal, Magento, and custom Laravel/Symfony applications, public exploit payloads are expected to follow shortly after official technical details are disclosed.

What are we doing?

The Detectify Security Research team is actively monitoring the situation:

• Detectify has deployed five distinct scanning assessments to detect CVE-2026-109618 and CVE-2026-109619 across customer attack surfaces.
  These security tests combine insights from early public proofs-of-concept (PoCs) alongside internal research using unique detection methods, and they utilize safe, non-destructive detection mechanisms rather than proving full RCE execution chains. Our research team continues to iterate on both general and technology-specific modules to maximize coverage.
• Asset discovery: Detectify’s Surface Monitoring continuously maps internet-facing assets running PHP web applications, helping security teams locate shadow or legacy PHP workloads.

How to mitigate the threat

IMPORTANT NOTICE: The temporary measures and configuration adjustments listed below only reduce exposure surface vectors. Only applying the official PHP patch or upgrading to a secure version will mitigate these vulnerabilities.

To ensure your organization remains protected, we recommend taking the following steps immediately:

1. Upgrade your PHP installation: Upgrade your environment to the latest patched version for your respective branch:

• PHP 8.2: Upgrade to 8.2.35
• PHP 8.3: Upgrade to 8.3.36
• PHP 8.4: Upgrade to 8.4.27
• PHP 8.5: Upgrade to 8.5.12
  

Note on legacy/EOL releases: Given the severity of these vulnerabilities, the PHP security team has provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to assist teams building directly from source or operating without access to an LTS vendor. Otherwise, organizations running End-of-Life (EOL) versions should look for distribution backports (e.g., from OS vendors like Ubuntu or RHEL) or migrate immediately to supported 8.x branches.

2. Temporary Exposure Minimization Measures: If immediate upgrading is delayed, apply the following hardening steps to reduce risk vectors across vulnerable runtimes:

A. Mitigating RCE via OOM Corruption (CVE-2026-109618)

• Set unlimited memory limits: Set memory_limit=-1 via administrative configuration (e.g., php_admin_value in FPM pools or Apache config) so applications cannot override it. Confirm that no downstream pool, directory, or application settings re-impose a finite limit. Note: This prevents user-controllable PHP memory limit failures, though system-level allocation failures can still hit the vulnerable path.
• Restrict request payloads: Lower post_max_size (e.g., 8M for non-upload applications, 32M if uploads are required). Ensure upload_max_filesize remains strictly below post_max_size. Enforce limits at the web server or proxy layer for decoded request sizes, input field counts, multipart part counts, header counts, and nesting depth—including requests lacking a usable Content-Length.
• Enforce availability boundaries: Use container or cgroup limits with policies designed to kill only the affected worker. Avoid relying on RLIMIT_AS or RLIMIT_DATA, as these can directly trigger the vulnerable allocation failure.

B. Mitigating RCE via Stale Global State (CVE-2026-109619)

• Disable Session Upload Progress: Set session.upload_progress.enabled=0 via global php.ini, FPM pool, or server configurations applied prior to request parsing (do not rely on ini_set() or .user.ini). Restart all workers afterwards.
• Disable backtraces (PHP 8.5): If running PHP 8.5, set fatal_error_backtraces=0 and restart workers to disable the confirmed fatal backtrace path.
• Clean up diagnostics & configuration: Remove invalid or deprecated per-request settings that generate diagnostic output before initialization completes. (Hiding outputs using error_reporting, display_errors, or @ does not prevent the vulnerability).
• Address fatal triggers: Resolve reachable fatal errors and execution timeouts, including failure points in callbacks, file uploads, import processing, or cleanup logic.

3. Inventory internet-facing assets: Use Detectify to run an asset discovery scan to identify all exposed HTTP service endpoints and web applications running on PHP.

4. Deploy patches across pipelines: Ensure application owners and infrastructure operators pull updated PHP packages from upstream package managers (Debian, Ubuntu, RHEL, Docker Hub, etc.).

5. Isolate high-risk services: If immediate patching is not possible, temporarily isolate vulnerable application servers behind access-controlled gateways or Web Application Firewalls (WAFs) with strict filtering enabled.

References & official advisories

PHP Security Release Announcement (2026-10-21-5)
PHP Foundation Announcement Archive (2026-10-20-1)
CERT-EU Security Advisory 2026-018

The post Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) appeared first on Blog Detectify.

YouTube is rolling out GIF comments for videos and Shorts. Learn how they work, who has access, and what the update means for viewers and businesses.

The post YouTube Rolls Out GIF Comments: What Viewers Can Use So Far appeared first on TechRepublic.

YouTube is rolling out GIF comments for videos and Shorts. Learn how they work, who has access, and what the update means for viewers and businesses.

The post YouTube Rolls Out GIF Comments: What Viewers Can Use So Far appeared first on TechRepublic.

Most tools will only test the domains you already know about. We’ve decided that’s not enough.

TLDR: Detectify’s new Apex Discovery automatically identifies root domains likely to belong to your organization (from M&A, subsidiaries, and shadow IT) for complete security coverage. Review and confirm our curated suggestions in a click, and instantly start protecting them with the same continuous discovery and vulnerability assessment as the rest of your attack surface. Detectify does the heavy lifting while your team stays in control.

You might own a domain from a startup you acquired three years ago, a regional variant of a subsidiary registered without telling security, or a marketing microsite someone spun up and forgot. 

Most organizations simply don’t have a complete picture of their attack surface, and every unmonitored domain is a blindspot that can quietly harbor vulnerabilities no one is watching. Your existing tooling can only monitor what you feed it, which means your real attack surface is almost always larger than the one you’re watching. 

We believe knowing your known domains isn’t enough. To truly secure your attack surface, you first have to know how big it actually is, and that starts at the apex.

We have launched Apex Discovery, a core enhancement to attack surface management in Detectify. This isn’t just a WHOIS lookup; it’s a custom-built attribution engine that connects domains to your organization using multiple ownership signals directly into your Detectify workflow. 

Engineering a better attribution engine

A key part of what we do at Detectify is building unique solutions that provide significantly more value to your team than standard tooling. Apex domain attribution is a genuinely hard, under-researched problem, and it’s even harder in the EU, where GDPR limits most of the ownership signals in WHOIS data. That’s exactly the kind of problem we like to solve:

• Automated attribution techniques combined: Rather than relying on a single data point, we combine multiple signals to connect domains back to your organization, casting a wide net.
• High-confidence candidates, not noise: Domain ownership can’t be proven with 100% certainty by a machine, so instead of dumping raw results on you, we filter through various attribution methods to curate candidates with high confidence, surfacing the ones most likely to be yours so you can review and verify ownership. 
• Uncovering the invisible: Domains from M&As, subsidiaries, and shadow IT are most likely to be unmonitored and quietly contain risk. With Apex Discovery, you can find vulnerabilities continuously with the same security as for your other domains.

How does Apex Discovery work?

Because attribution is probabilistic, we built the workflow around review and verification rather than blind automation. From your highly curated list of candidates, you can:

• Confirm the domains that belong to your organization.
• Add confirmed domains as assets to your team in a single step.
• Verify ownership of those assets.
• Dismiss anything that isn’t yours, so your list stays clean, and your next review is always sharper.

This semi-automated approach means you get the reach of automated discovery without giving up control over what actually lands in your inventory.

Automatically identify apex domains belonging to your organization for a complete external security coverage, and review curated domain suggestions.

What’s new in your dashboard?

We’ve integrated Apex Discovery directly into your Surface Monitoring workflow to make it actionable:

• A curated candidates list: A dedicated place to review potential apex domains attributed to your organization.
• One-click confirmation: Confirm a domain and add it as an asset in the same motion, then move straight into ownership verification.
• Full coverage from day one: The moment you confirm and start scanning a domain, it inherits the same continuous discovery and vulnerability assessment you already rely on for your known assets, with the possibility of always adding configuration on the new root. 
• Dismiss and refine: Clear out domains that aren’t yours to keep future suggestions focused and relevant.

Get started

The best way to understand your exposure is to see how much of it you didn’t know about. Head to your Detectify dashboard to review the apex domains we’ve attributed to your organization, confirm what’s yours, and bring it under continuous control.

Book a demo to talk to our experts or start a 2-week free trial to see it in action.

The post Introducing Apex Discovery to secure every domain you actually own appeared first on Blog Detectify.