An attacker’s perspective on CVE-2026–109618 and CVE-2026–109619, explained in simple language.

Two bugs in the language behind most of the web, explained in plain language and in a comic strip.

TL;DR On October 22, 2026, Okta disclosed four Okta Access Gateway vulnerabilities in three advisories. They include the PHP2Shell flaws in its PHP runtime and a CVSS 9.1 command execution bug in …

I just finished the TryHackMe room on PHP2Shell, and this is what I learned:

Upload Progress

Most of the internet runs on PHP. We are talking about roughly 70% of all websites. So when a security hole is found inside the very engine…

An overview of the two PHP runtime vulnerabilities, their potential impact, affected versions, and available fixes

Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.

426 mobile apps connecting to servers advertising PHP versions potentially affected by PHP2Shell vulnerabilities, raising concerns about backend security.

Two critical vulnerabilities. A CVSS score of 9.2. Potential exposure on a massive scale.