VU#763488: Memory corruption vulnerabilities in PHP
2026-10-23T08:52:01Z•4524ec9a7fcbba1d444a35943def696b213896301460bdcef059a5d6bb6d39f7
CVE-2026-100156CVE-2026-109618CVE-2026-109619CVE-2026-16753CVE-2026-34073CVE-2026-3547CVE-2026-3833CVE-2026-96679CVE-2026-96681CVE-2026-97406BishengBoringSSLKomodoLowcoderOS-command-injectionPHPTLSXerjauthentication-bypassauthorization-bypasscertificate-validationcredential-persistencememory-corruptionmulti-tenant-data-exposurename-constraintsprivilege-escalationremote-code-executionuse-after-freevulnerability
What happened
CERT/CC advisories describe multiple vulnerabilities, including unauthenticated remote code execution in PHP, persistent credential minting in Xerj, certificate Name Constraints validation inconsistencies across TLS libraries, authentication and authorization flaws in Bisheng and Lowcoder, and root-level OS command injection in Komodo Periphery.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 4524ec9a7fcbba1d444a35943def696b213896301460bdcef059a5d6bb6d39f7
- Enrichment time
- 2026-10-23T08:52:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.