Tag archive
Two critical PHP flaws let attackers run code on a web server without logging in. Which sites are affected, the fixed PHP versions, how to check yours on shared hosting, WordPress, VPS or Docker, and why the popular workaround isn't enough.
Hey everyone, The PHP security team has dropped emergency security releases (PHP 8.5.12, 8.4.27,...
How to verify that a PHP2Shell patch actually removed the vulnerable process, and why the hunting window starts four days before disclosure.
Two PHP flaws, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), allowed access to online systems without a password. With PHP used by about 70% of websites
Web admins deployed patches for the newly public PHP2Shell vulnerabilities after automated exploitation attempts surged within hours. Cloudflare recorded m
A critical security vulnerability, CVE-2026-109619, has been discovered in PHP. This vulnerability is...
A new critical security vulnerability, CVE-2026-109618, has been reported in PHP. It is part of the...
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a critical unauthenticated RCE in PHP itself. Check your version, patch today, and hunt for compromise.
On October 21, 2026, the digital world woke up to a security emergency of unprecedented scale. A pair...
What 56 million PHP and 5.5 million Node.js fingerprints can and cannot say, and the four unknowns that decide remediation.
AWS researchers detected attempts targeting two PHP security flaws on Oct. 17; official fixes were released on Oct. 21. Known together as PHP2Shell, the fl
PHP has released emergency updates for two severe runtime flaws named PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619. Affecting versions back to