Critical security flaw puts most websites at risk as NSA issues warning

The issues would allow bad actors to steal information or launch a cyberattack on anyone visiting a hacked website.

php2shell: Critical flaws allow code injection in PHP

Two flaws expose PHP web servers to remote attacks. Versions from the past 20 years are affected; admins should patch.

PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.