Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In the span of a few days, we saw PHP2Shell, a set of critical remote code execution vulnerabilities in core PHP itself. That’s not in an application built on PHP, but in the engine that powers roughly 70% of the websites on the internet. Every PHP version released in the last decade was affected.

When a new PHP vulnerability is disclosed, the first question is simple: Is your PHP runtime affected, and what should you do? To help simplify the process, Astra has launched a free PHP2Shell Checker that lets you enter a public URL, check the PHP version it exposes against the listed fixed releases, and understand what to investigate next. Check your PHP exposure for free →

On October 21, 2026, the PHP project shipped emergency releases for two critical memory-safety bugs in the PHP core itself: CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell. Both are rated CVSS 9.2. Both are reachable before any application code runs, which means a “Hello World” PHP page is as exposed as a full WordPress install. And both were being probed in the wild before the fix was public.

The Evo Remediation Agent is now in Open Preview, bringing automated dependency resolution to Evo Agentic AppSec. AppSec teams can now run ongoing remediation campaigns across repositories and deliver proposed fixes to developers through validated pull requests. Fixing a dependency vulnerability can mean choosing an upgrade, resolving dependency conflicts, adapting the application, and/or checking the result. That work competes with everything developers are already building.

On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities known as PHP2Shell that can enable unauthenticated remote code execution. Cato’s self-evolving CVE mitigation agent helped turn the investigation into concrete research output by creating a proof of concept and generating an IPS signature in minutes. The agent connects vulnerability analysis, controlled lab testing and protection generation.

PHP powers roughly 70% of websites on the internet. WordPress, Drupal, Joomla, and thousands of custom applications run on it. At Astra, we’ve spent years protecting these applications with firewalls, malware scanning, and vulnerability detection. So when vulnerabilities show up in PHP’s core engine, it’s worth paying attention. On October 21, 2026, two critical PHP vulnerabilities were publicly disclosed under the name PHP2Shell.

From PHP vulnerabilities to supply-chain compromises, security teams are being forced to make difficult decisions about patching, exposure, and business continuity. Here’s the response from security leaders on critical incidents and the learnings on the front lines. Some days in cybersecurity are busier than others, and then there are days when everything seems to go wrong at once…like October 21.

This week, two big vulnerabilities are in the news. The first one is the PHP2Shell vulnerability, for which a Zeek detector was published yesterday. The second, equally important, vulnerability is the compromise of some intermediate certificates of the eMudhra Certificate Authority (CA).

Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code. Who is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.