CVE-2008-1903: PHP remote file inclusion vulnerability in news_show.php in Newanz NewsOffice 1.0 and 1.1, when register_gl...

Security readout for executives and security teams

CVE-2008-1903 affects Newanz NewsOffice 1.0 and 1.1 when PHP register_globals is enabled. A remote attacker may make the application include attacker-controlled PHP through news_show.php, leading to arbitrary code execution on the web server. Exposure is likely limited to legacy Newanz NewsOffice 1.0 or 1.1 installations with news_show.php reachable and PHP register_globals enabled. The provided CPE data is empty, so asset discovery may require file, URL, or application inventory checks. Prioritize any internet-facing instance because successful exploitation can become server-side code execution. For most organizations, the main risk is forgotten legacy PHP software rather than modern managed platforms. Mitigation focus: Disable PHP register_globals wherever this application remains deployed.; Remove or isolate unsupported Newanz NewsOffice deployments.; Restrict public access to news_show.php until remediation is confirmed..

Prepared

Jun 28, 2026, 19:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.