Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.

426 mobile apps connecting to servers advertising PHP versions potentially affected by PHP2Shell vulnerabilities, raising concerns about backend security.

Warnings had surfaced years earlier, but the discovery of serious attack methods triggered a chaotic race to release security fixes.

Prefer the deep-dive…

One request. No login. A decade-old flaw in the PHP engine, finally weaponized.

TL;DR On October 23, 2026, the PHP team disclosed CVE-2026-115560, a new PHP session vulnerability tied to session upload progress. It can lead to remote code execution, but only in a rare setup. …

PHP2Shell: Web’in %69'unu Etkileyen Kritik PHP Açıkları (CVE-2026–109618 & 109619) Evet arkadaşlar yaklaşık 2 gün önce karşımıza PHP2Shell adında çok geniş kapsamlı ve çok …

PHP2Shell: CVE-2026–109618 and CVE-2026–109619

Hello, welcome to a fool’s guide to cybersecurity today, we’re talking about two critical flaws within PHP. Two critical vulnerabilities…

How I read the vulnerable PHP source, triggered the OOM condition by hand, found the one-line patch and learned why the runtime is the…