WAF

14 min readCVEPHP

PHP2Shell: How to Protect Your Website From the Critical New PHP Vulnerability

CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell, let an attacker take over a PHP server remotely with no password. Plain-English facts, what to do now, and how a WAF fits in.

Security News View all →
The Register Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure 2026-10-22 The Register Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants 2026-10-22 The Hacker News Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation 2026-10-22 The Hacker News OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL 2026-10-22 SecurityWeek Cisco Patches 34 Vulnerabilities Across Multiple Products 2026-10-22 The Register IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall 2026-10-22