24 Hours After PHP2Shell: Who Patched, Who’s Still Exposed
Quick response by shared and managed hosting providers has led to a sharp jump in patched sites. On Wednesday, PHP.net shipped an emergency fix for two critical, remotely […]
Read the evidence
PHP2Shell: Critical PHP RCE Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
On October 21, 2026, the PHP project shipped an emergency fix for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). We analyzed 6.7M of the world’s most-visited PHP sites to […]