Skip to content
Vulnerabilities in PHP and Nextcloud Under

Vulnerabilities in PHP and Nextcloud Under

First seen 25 Oct 2026, 10:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 25, 2026 at 12:12 UTC
  • •CVE-2026-115560 requires specific configurations to be exploited, but mitigation is advised.
  • •CVE-2026-110447 is actively exploited, allowing command execution on vulnerable Nextcloud servers.
  • •PHP has released emergency patches for critical vulnerabilities just days before the new warning.

PHP has issued a warning about CVE-2026-115560, a code execution vulnerability that affects specific configurations of the language, recommending disabling session upload progress as a temporary mitigation. This follows the patches released for PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on October 21, which had a CVSS score of 9.2 and were exploited within 24 hours. Meanwhile, Nextcloud is facing of CVE-2026-110447, a flaw that allows unauthenticated attackers to execute arbitrary commands on servers using Collabora Online with an integrated CODE server. This vulnerability, reported on October 14, has been confirmed to be exploited since September, with attackers deploying web shells and searching for sensitive credentials. Administrators are urged to update to version 26.4.303 to mitigate these risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-14
CVE-2026-110447 published
Nextcloud vulnerability allowing command execution was disclosed, affecting versions before 26.4.303.
Ciberseguridadlatam
2026-10-21
Emergency patches for PHP2Shell released
PHP released patches for CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 CVSS.
Ciberseguridadlatam
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-23
CVE-2026-115560 disclosed
PHP warned about a new vulnerability affecting specific configurations, recommending disabling session upload progress.
Ciberseguridadlatam
2026-10-23
CVE-2026-110447 added to CISA KEV
CISA confirmed active exploitation of the Nextcloud vulnerability, urging immediate updates.
Ciberseguridadlatam

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 4

Common questions

Which PHP configurations are vulnerable?
CVE-2026-115560 affects applications with specific session settings, requiring three conditions to be met.
Is Nextcloud CVE-2026-110447 actively exploited?
Yes, it has been confirmed that this vulnerability is being actively exploited since September.
What should I do if I'm using Nextcloud?
Immediately update to version 26.4.303 to mitigate the risk of exploitation.