Browsing Tag

PHP security

3 posts

This Week in Security: Firewall Fixes, a Rented Banking Trojan, a Blank PDF and Stolen Tokens. What to Actually Do

A bright white desk with a small network appliance, a smartphone, a blank sheet of paper, a brass key and a padlock laid out in a row
Six of this week’s thirty security stories, checked against the original advisories, each with one clear action: Fortinet’s critical firewall fixes and the still-active FortiBleed campaign, a rented Android banking trojan, a blank PDF invoice that opens a backdoor, a Microsoft Authenticator token flaw, 32 fake AI bots hunting for secrets, and why CISA’s must-patch list is a floor. Patch order for companies, a checklist for users.
View Post

The 22-Year Road to PHP2Shell: How AI-Assisted Review Finished an Old Story

Comic illustration: a researcher in a white hoodie stands beside a server rack and a faceted geometric blue elephant, while a glowing turquoise thread runs from an old archive box to a small turquoise shield
PHP2Shell was fixed on October 21, 2026, but the story starts with a 2004 advisory about unsafe interruptions. An illustrated retelling, inspired by Calif’s php2shell comic: how Calif, OpenAI and Wiz used frontier AI models to finish a 22-year-old line of research, what half-built data and stale state mean, who contributed what, and what AI changed and did not change.
View Post

PHP2Shell and a Node.js Security Release on the Same Day: What to Patch, Restart and Check Now

A technician in a light grey shirt slides glowing turquoise server modules into an open white rack in a bright data hall with tall windows and blue sky
PHP fixed two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On the same day, Node.js shipped fixes for ten vulnerabilities in 22.23.4, 24.22.1 and 26.12.1. What changed, who is exposed, which cloud platforms patch for you, how to check your version, and a patch-and-restart checklist for website owners, small businesses and admins.
View Post