Tag

PHP

4 stories

Urgent PHP Windows Builds Patch Critical HTTP2Shell Vulnerability

The PHP project has released updated Windows builds to mitigate a serious flaw known as HTTP2Shell. Announced on October 26, 2026, the new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1; each Windows build now includes an updated Brotli library (1.2.1) that fixes CVE-2026-111497. Administrators running PHP on Windows should treat these updates as urgent and apply them promptly. Release details The "-1" suffix in the version numbers denotes Windows…

Saugata DattaOct 27, 20263 min read195

Cybersecurity

PHP2Shell and the PHP scare that nearly stopped the web

On Wednesday, a pair of long-dormant vulnerabilities in PHP sparked an emergency scramble across the internet. The bugs—dubbed PHP2Shell and assigned CVE‑2026‑109618 and CVE‑2026‑109619—allow unauthenticated remote code execution on affected systems. Once researchers demonstrated exploitability, vendors and web hosts rushed to apply patches released by the PHP Foundation, while companies and governments warned users and some organizations temporarily took services offline to protect themselves. What happened Security researchers at Calif…

Saugata DattaOct 24, 20264 min read247

Cybersecurity

PHP’s New Warning: Narrow Unpatched RCE Path After PHP2Shell Fixes

PHP released a short advisory on October 23 warning of a separate, unlikely path that could let an attacker run code on a web server — just two days after emergency fixes for the critical PHP2Shell flaws. While the newly disclosed issue (CVE-2026-115560) is not being treated as an emergency, administrators should understand the configuration that creates the risk, confirm whether their apps are affected, and apply the recommended mitigation…

Saugata DattaOct 23, 20264 min read270

Cybersecurity

Global websites taken offline after critical PHP vulnerability forces emergency patches

Websites around the world went dark this week after security researchers uncovered a serious flaw in PHP, the programming language that underpins roughly 70% of the web. Governments and organisations ordered precautionary takedowns while a patch was released, but experts warned that a long tail of unmaintained sites could remain vulnerable for weeks or months — creating a persistent window for exploitation. What happened Researchers reported a critical vulnerability in…

Saugata DattaOct 22, 20264 min read290

Urgent PHP Windows Builds Patch Critical HTTP2Shell Vulnerability

PHP2Shell and the PHP scare that nearly stopped the web

PHP’s New Warning: Narrow Unpatched RCE Path After PHP2Shell Fixes

Global websites taken offline after critical PHP vulnerability forces emergency patches

Free Tools: IP, DNS, SSL