#Php2shell

Multiple vulnerabilities have suddenly been reported online, so let's figure out how we got here

Ministers report 32 unavailable and four partly disrupted, but no confirmed compromise

Two critical pre-authentication RCE flaws in PHP (CVE-2026-109618 and CVE-2026-109619), uncovered by AI models from OpenAI and Google Gemini, sparked a global patching scramble across 70% of the web.…

Two memory bugs hid in PHP’s error handling for years. Then a leak, an accidental video, and AI-assisted exploit development turned them… Continue reading on JavaScript in Plain English »

I published PHP2Shell, a proof-of-concept for two critical PHP vulnerabilities — CVE-2026-109618 and...

PHP2Shell (CVE-2026-109618/-109619, CVSS 9.2) is under broad attack. Which OT devices run PHP, why patching takes years, and what to do now.

What 56 million PHP and 5.5 million Node.js fingerprints can and cannot say, and the four unknowns that decide remediation.

The most-read story on daily.dev today is not a new framework or a benchmark — it is an emergency: on...

Introduction On October 21, 2026, the PHP project shipped emergency security releases for...

Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.