Check the status of CVEs. Learn More.

 CVE Status (opens in new tab)

php2shell patches (CVE-2026-109618 and CVE-2026-109619) for EOL PHP are out now. With sales replies slower than usual due to high demand, the fastest route to patched packages is to buy ELS for Runtimes online (opens in new tab). Read the patch FAQ

TuxCare will be at QCon San Francisco 2026, a conference for senior software engineers, architects, and team leads where every session is selected by working practitioners, taking place November 16–18 at the Hyatt Regency San Francisco on the Embarcadero. Find us at Booth #13, where we’ll be talking about software supply chain security, what’s really inside your dependencies, and how to keep your open source stack secure over the long term.

Our team will be onsite across all three days to meet with developers, architects, and engineering leaders, trade notes on supply chain risk, and talk through how SecureChain by TuxCare helps teams catch risky and malicious packages before they make it into production.

 

Catch Our Talk

The Men in Black Know What’s in Your JavaScript and How to Fix it!

Chris DeMars, TuxCare  Wednesday, November 18 · 11:45 AM–12:35 PM PST · Pacific LM

Ever wonder what’s hiding in the dark corners of your node_modules? With software supply chain attacks on the rise, knowing exactly what you ship matters. In this session, Chris explains why frontend developers should care about SBOMs (Software Bills of Materials) and how to generate one with tools like CycloneDX and Syft. You’ll leave knowing how to map your full dependency tree, add SBOM generation to your build process, and spot known vulnerabilities before they reach your users.

Come find us at Booth #13. Whether you want to catch the talk, dig into supply chain security, or just say hi.

See you in San Francisco!