Vulnerabilities
9.8 CVSS PHP Injection in WineShop <= 3.20 Leaves Users Exposed Without Patch
ThemeREX WineShop versions up to 3.20 contain a critical unauthenticated PHP object injection flaw rated 9.8 CVSS with no confirmed patch available yet.
PHP
Everything DataSafe Times has reported about PHP: 2 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
CVE-2026-105830: Unauthenticated attackers can exhaust PHP CPU via quadratic table parsing in commonmark
Unauthenticated attackers can exhaust PHP worker CPU via quadratic-time table parsing in versions prior to 2.10.2.