ainotis Join
My notis

Checked fact 249323 Oct 2026Safety and security

Calif says it confirmed pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, Magento 2.4.9, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS ("We confirmed pre-auth RCE on the following PHP apps as well as arbitrary PHP scripts in some instances.").

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

The exact words it rests on

We confirmed pre-auth RCE on the following PHP apps as well as arbitrary PHP scripts in some instances. - WordPress 7.1.2 - Drupal 11.4.3 - Joomla 6.1.4 - MediaWiki 1.46.2 - Roundcube 1.7.4 - Magento 2.4.9 - phpMyAdmin 5.2.3 - Nextcloud 35.0.1 - Laravel 13.11 - Symfony 8.1 - WHMCS

What the source said when we opened it, on 23 Oct 2026.

The source

php2shell: a tale of two PHP remote vulnerabilities
Calif · 2026-10-21

Open the sourcearchived copy

Checked

Checked by the notis newsroom on , against the source above.

In the story

PHP patches two critical remote code execution flaws 23 Oct 2026

Cite this fact

Anyone may quote this address. It does not change; if we correct the story, this page says so.