4 stories for “PHP2Shell”
CISA added the two critical PHP vulnerabilities to its list of actively exploited flaws and ordered federal agencies to patch by October 29. Those who cannot update are told to take their servers offline.
Many organizations do not know which PHP versions their servers run. A non-intrusive check that compares the version a server reports with the patched versions can give an initial picture. Moshe Levi of Levinity Cyber explains what it reveals, and what it does not.
PHP2Shell proved that AI models are already excellent vulnerability hunters. The real security problem of 2026 is not finding flaws, but patching faster than the attackers.
Two severe PHP vulnerabilities allow remote code execution without authentication. Patches are out, exploitation attempts are already here, and there is no safe workaround.
