PHP2Shell: understanding the October 2026 PHP flaws and checking your servers
PHP2Shell is the name given to two PHP vulnerabilities published on 21 October 2026, CVE-2026-109618 and CVE-2026-109619. They allow, with a simple HTTP request and no authentication, running code on a server that runs PHP. With PHP powering about 70% of websites whose server technology is known (WordPress, Drupal, Joomla and a host of applications),…