TL;DR QNAP says the QNAP PHP2Shell vulnerabilities affect QTS, QuTS hero, QuTScloud and several QNAP apps. The two flaws, CVE-2026-109618 and CVE-2026-109619, let unauthenticated attackers run cod…

Web Exploitation | PHP | GHSA-w8hw-w9fx-j79w

An attacker’s perspective on CVE-2026–109618 and CVE-2026–109619, explained in simple language.

Two bugs in the language behind most of the web, explained in plain language and in a comic strip.

TL;DR On October 22, 2026, Okta disclosed four Okta Access Gateway vulnerabilities in three advisories. They include the PHP2Shell flaws in its PHP runtime and a CVSS 9.1 command execution bug in …

I just finished the TryHackMe room on PHP2Shell, and this is what I learned:

Upload Progress

Most of the internet runs on PHP. We are talking about roughly 70% of all websites. So when a security hole is found inside the very engine…

An overview of the two PHP runtime vulnerabilities, their potential impact, affected versions, and available fixes

Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.