Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

PickleScan has multiple stdlib modules with direct RCE not in blocklist

Fix availableCritical · CVSS 9.8EPSS 1.1%

Published Mar 3, 2026 · updated Sep 25, 2026

What to do

  1. Upgrade to a fixed version: picklescan 1.0.4.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIpicklescan23,726 downloads/week

Vulnerable versions
< 1.0.4
Fixed in
1.0.4

Check your project: pip show picklescan

Sources

CWE-184 Incomplete List of Disallowed Inputs · CWE-693 Protection Mechanism Failure

← All critical vulnerabilities