https://www.hadosec.com/tags/php/Recent content in PHP on Hadosec — Application & AI Security for SMEsHugoenFri, 23 Oct 2026 00:00:00 +0000https://www.hadosec.com/blog/php2shell-critical-php-vulnerability/Fri, 23 Oct 2026 00:00:00 +0000https://www.hadosec.com/blog/php2shell-critical-php-vulnerability/<p>On 21 October 2026, the PHP project shipped emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known together by the name security researchers gave them: <strong>PHP2Shell</strong>. Both let an attacker take over a web server remotely, with no password and no user interaction, and together they affect software running roughly 70% of all websites on the internet. If you run PHP anywhere, directly or through WordPress, Drupal, Joomla, or Magento, this post explains what happened, what the jargon means, and exactly what to do about it.</p>