Apache

Critical PHP Core Flaws Enable Unauthenticated Remote Code Execution

The PHP project released emergency patches on October 21 for two critical vulnerabilities in the language core, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell. Both issues received a CVSS 4.0 score of 9.2 and allow remote code execution without authentication. CVE-2026-109618 resides in memory-handling routines where longjmp can leave request data partially initialized, and subsequent shutdown operates on invalid data; multipart requests with many headers or empty file fields can trigger the condition. CVE-2026-109619 affects an obsolete global state in long-lived workers that retain references to freed memory, with confirmed paths involving fatal errors, error reporting data, and session upload progress. Researchers demonstrated unauthenticated code execution over HTTP against the first flaw on Apache with mod_php using default limits, while PHP-FPM exposure was identified through code analysis. The FBI Cyber Division issued an alert urging immediate updates, and Cloudflare deployed WAF rules while confirming early attacks in the wild.

From Root CA to User Authorization in nginx and Apache: Client Certificate Login Explained

This is the third installment in a detailed tutorial series covering the deployment of a two-tier PKI infrastructure with Root CA and intermediate CAs for Person, Server, and Code. The article provides comprehensive configuration guidance for enabling mTLS in nginx and Apache, including full references for all ssl_client_* variables and SSL directives. It explains the differences between password-based and certificate-based authentication, the TLS handshake steps involving CertificateRequest and CertificateVerify, and the importance of proper extendedKeyUsage settings such as clientAuth. Readers learn how to issue client certificates, package them in PKCS#12 format, enforce revocation checks via CRL and OCSP, and safely pass certificate fields to backend applications while mitigating risks from header spoofing. The guide also covers scenarios where the application itself terminates TLS without a reverse proxy and demonstrates login flows protected against CSRF using one-time tokens.