Scanning with Metasploit

PHP2Shell: How a Core Runtime Zero-Day Broke the Web (CVE-2026–109618 & CVE-2026–109619) Inside the low-level C memory corruption granting unauthenticated RCE across millions of production …

Independent Research · 2026

Protections have been added against scams and social engineering, including new site warnings and server-side Gemini analysis.

I took a public PHP vulnerability proof of concept and, within roughly three hours, had a working demonstration of code execution.

*Flipper Zero • M5Stick • LILYGO T-Embed • ESP32-S3 • Evil Twin • Fake Wi-Fi • Beacon Flood • Bluetooth Spam • CASPER AI Voice Alerts*

The NSA disclosed massive backdoors today. PHP with two critical unauthenticated remote code execution bugs already being used. LiteLLM…

Inside a sophisticated malware campaign targeting telecommunications, universities, government contractors, and other organizations.

🚨 When the tool that detects breaches becomes the entry point, the risk goes beyond one server.

You would have heard about the PHP articles in news today (if not you could check it out here) but did you know about another significant…

Book review and learning reflections on the second edition by Patrick Engebretson.

Operating Systems: Introduction

Hacker Holidays: Beach Bar — Write-up

Learn how to document malware behavior, analyze technical evidence, assess risk, and write clear cybersecurity reports with practical…

CVE-2026–109618 & CVE-2026–109619 — pre-auth RCE in PHP core, explained for the rest of the team.

The security of a web application depends on more than the code developers write.

A step-by-step tale of identity confusion, state corruption, and a seamless resolution.