Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Last updated: October 22, 2026. This story is still developing, and we'll update this post as new details are confirmed. Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, are putting a large share of the web at risk. The vulnerabilities, collectively named PHP2Shell, both carry a CVSS score of 9.2, and both allow remote code execution (RCE). Security teams should treat these vulnerabilities urgently and respond accordingly.

On Oct. 21, 2026, PHP fixed a vulnerability named php2shell by Calif. Pre-auth RCE under default configurations, confirmed on common CMS, webmail, e-commerce, file sharing, and database administration applications. A PHP server also stores and uses credentials, so this is a secret theft vector.

Railway's security incident may have exposed decrypted customer environment variables. Pull and scan yours with GitGuardian to know what to rotate first.

LevelBlue’s free Zero Trust Readiness Review helps organizations uncover security gaps and get more value from their existing investments. One of the first questions I ask security leaders is simple: Do you know whether all your security tools work together? The answer is rarely a straightforward yes. Most organizations have built their security environments over many years.

Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, allow attackers to execute code on vulnerable web servers without authentication. PHP released fixes on October 21, 2026, including versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. But patching your servers is only part of the response. Organizations must also understand what their websites delivered to customers during the exposure window, including scripts served by third-party vendors whose infrastructure may have been vulnerable.

A valid digital signature is a green light for Windows, browsers, and “Microsoft SmartScreen” protection: this file comes from the publisher mentioned in the digital signature, and it has not changed since it was built. By signing code, you are trusting to ensure that the code is safe for your machine. Digging up the asset is not just their public.cer file, which is everywhere in a certificate store; it is the key that is vital for the creation of the signature.

Keeper Security, the leading zero-trust and zero-knowledge identity security platform, today announces Phishing Protection, a new feature in the Keeper Browser Extension that warns users before they enter credentials on fraudulent login pages. Built on a zero-knowledge local AI engine, the feature detects look-alike domains, spoofed websites and brand impersonation directly in the browser, helping users avoid handing over credentials to a cybercriminal.

On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to by researchers as PHP2Shell. Both vulnerabilities carry a CVSS v4.0 score of 9.2 (Critical Severity) and can allow an unauthenticated attacker to execute code with the privileges of the affected PHP worker process.

Two critical vulnerabilities in the PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, let an unauthenticated attacker run commands on servers that use an affected PHP build to handle web requests. PHP released fixes on October 21, 2026, a day after details leaked online. Public proof-of-concept code followed within hours, and exploitation attempts were seen as early as October 17. AppTrana customers have been protected against PHP2Shell.