Security Oct 25, 2026
PHP2Shell: the PHP sites in real danger are the ones nobody upgradedPHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers run code on PHP servers without logging in. The fix shipped on 21 October 2026. The sites in real danger are the ones on PHP 8.1 and older, which get no official patch. Here is who is at risk, how to check your version, and what to do today.
Read article