Yesterday, two critical vulnerabilities were disclosed in PHP, the scripting language used by many websites and online services: CVE-2026-109618 and CVE-2026-109619. Attackers can exploit them to remotely execute commands on any server running PHP, with no authentication required. The exploit has been dubbed PHP2Shell.

The PHP security team announced an upcoming emergency update on October 20 and released patches fixing the vulnerabilities the following day.

We’ve already covered the technical details of these vulnerabilities and explained what companies and server administrators should do. You may have safely skipped that news because you don’t run any servers — but unfortunately, the issue is not limited to businesses.

Nearly 70% of websites run on PHP, including services we use every day: wikis, online stores, smart devices with web interfaces, home network-attached storage (NAS), smart-home controllers, and much more.

Today, we explain how these vulnerabilities could affect you personally and what you can do to reduce the risks.

How the vulnerabilities can affect home users

Account and personal-data theft

The vulnerability allows an attacker to steal authentication tokens from server memory. These tokens essentially act like electronic passes — telling a website that the user has already signed in. As a result, an attacker may be able to access someone else’s account without entering a password or two-factor authentication code, putting messages, documents, delivery addresses, order histories, and other confidential information at risk.

Loss of files on home devices

If you have network-attached storage (NAS) or a video surveillance system at home that uses a vulnerable PHP version, it may also be at risk. Depending on what level of access they gain, attackers could potentially copy, delete or encrypt files they can access.

Malware infection

If an attacker gains access to a vulnerable website, they can use it in virtually any way they want: trick visitors into downloading a malicious file or clicking on a phishing link, display dangerous instructions, replace payment forms or login pages with malicious ones — the list goes on and on. As a result, someone visiting a legitimate website could not only lose access to their account, but also lose money or accidentally infect their device with malware.

Below are examples of services directly affected by the vulnerabilities.

Which services are affected by the PHP vulnerabilities

Jeedom

Jeedom is a smart-home platform that lets users control lighting, sensors, heating, blinds and home IoT devices. Attackers could abuse this in many ways: they could disable the alarm, track when the homeowner is away, access video from the door intercom, and more.

The developers confirmed that the new vulnerability affects their application, and have already released an emergency update — Jeedom 4.6.2. Users need to run the update twice for it to work. The developers say a fully fixed version for home users will be released in the coming days.

Websites we use every day

As mentioned above, PHP is used by roughly 70% of websites. This doesn’t mean every one of them is vulnerable: it depends on the PHP version in use and whether the site owners have already updated it. Many government websites in Europe have already suspended operations because of the new vulnerability.

Unfortunately, a website may still be vulnerable even if it appears to be working normally. An attacker could potentially take control of any legitimate website whose server hasn’t been patched yet. They could fake payment or login pages, host malicious files, or persuade users to download an “urgent update” that is actually malware.

Ordinary users have no reliable way to check whether such instructions or files are safe, so be sure to use reliable anti-phishing and antivirus protection. If you suspect that your data may have been stolen, check the active sessions in your account settings. If you spot suspicious activity or devices you don’t recognize, sign out of all active sessions and change your password. Use a password manager — it can generate a truly strong, unique password that you won’t have to memorize yourself.

Computer games

Bad news for gamers: some video games whose servers use PHP are also at risk. If you don’t want attackers to get hold of your accounts, be sure to update the passwords for your gaming platforms, stores and accounts.

To buy time for updates, some developers temporarily took their services offline. Final Fantasy XIV, Pokemon Champions, games from Bandai Namco Entertainment, Uma Musume: Pretty Derby, Granblue Fantasy, Shadowverse: Worlds Beyond, and many others went into emergency maintenance. Nintendo Switch Online and the GOG and Steam stores were also affected.

Unfortunately, there’ve also been more drastic consequences. Yesterday, the developers of World Quest announced that the game would shut down permanently after 15 years: it relied on outdated infrastructure that would have been extremely difficult and costly to fix. For the same reason, the mobile game Please Save My Pandemonium! shut down after more than ten years of operation.

Home network-attached storage (NAS)

“Home clouds” have become popular in recent years for good reason: many users prefer to keep backups of their data at home rather than online. A number of companies make NAS devices, and at least three — QNAP, Synology and ASUSTOR — have said the vulnerabilities affect their products. An update has also been released for Unraid, an operating system for home servers, network storage and media servers.

QNAP

The manufacturer confirmed that the vulnerabilities affect several versions of its NAS operating systems — QTS and QuTS hero — as well as applications including QuMagie, Note Station 3 and certain versions of QVR Surveillance. A successful attack could put photos, documents, notes and camera recordings at risk.

At the time of publication of this blogpost, QNAP is still preparing updates, so the main priority is to temporarily disconnect NAS from the internet. QNAP recommends disabling port forwarding on the router — to prevent NAS from automatically opening ports — and allowing access to the management panel only from the home network or through a VPN.

Synology

Both vulnerabilities have been officially confirmed in PHP packages 7.3, 7.4, and 8.0–8.4, as well as in Mail Station and Synology Calendar. Fixes have already been released for PHP, starting from version 7.4, as well as for Mail Station and Synology Calendar. PHP 7.3 won’t be fixed. The company separately notes that the PHP component built into its operating system cannot be reached from outside the device, so the risk of attack is very low.

ASUSTOR

ASUSTOR also officially confirmed both vulnerabilities, and immediately removed PHP 7, 7.3, 7.4, and 8.1 packages from App Central. The company recommends immediately backing up your data, removing older PHP packages, and using PHP 8.3 or 8.4.

Unraid

In today’s operating-system update, PHP was upgraded to version 8.4.27 with fixes for the vulnerabilities. The developers recommend that all users update to Unraid 7.3.4. Containers with their own PHP installation must be updated separately: the new PHP version in the operating system doesn’t replace PHP inside containers.

At the time of publication, we haven’t found public confirmation from other major manufacturers (such as TerraMaster, UGREEN, Buffalo, or Western Digital) that their devices are affected by these vulnerabilities — only user discussions on forums.

But the fact that only some NAS manufacturers have confirmed the problem so far doesn’t guarantee that your devices are safe — especially if they’re fairly old or come from a lesser-known or defunct manufacturer. In that case, first disconnect the devices from the internet while keeping them accessible only on the local network, and then investigate whether they’re vulnerable.

Nextcloud cloud storage

Nextcloud is a free, open-source platform for creating your own cloud storage, serving as an alternative to Google Drive, Dropbox, and Microsoft OneDrive. It lets you store and synchronize files across devices, share them with other users, and work with documents, photos, calendars and contacts. The data can be stored on your own server or NAS rather than on a third-party company’s servers.

If you store important data in Nextcloud, check how your cloud instance is configured. If you use Nextcloud All-in-One, update to version 14.4.1 where the vulnerability has already been fixed.

If your Nextcloud installation is configured differently, you need to update PHP yourself on the device or server.

How to protect your devices and data

• Use phishing and malware protection. Our security solution automatically blocks phishing pages and malware, even when attackers place them on legitimate websites.
• Keep an eye on updates. If you have network-attached storage, a smart-home system, a home server, a media server, or any other device with a web interface, first check the manufacturer’s website and install all available updates. If no update is available yet, temporarily disable internet access to the device.
• Use strong passwords. Most people reuse the same password, or variations of it, across multiple websites. If an attacker finds one of those passwords on a vulnerable server, they may be able to compromise your other accounts as well. We recommend generating and storing strong, unique passwords in Kaspersky Password Manager so you don’t have to remember your credentials yourself. Be sure to enable two-factor authentication on all important accounts — ideally using one-time codes generated by the same password manager.
• Keep an offline backup of important files. Don’t rely on cloud storage alone — make sure you keep a backup of all important documents on both a hard drive and an external device. For more information on how to make backups properly, see our article The internet remembers not quite everything.

What other risks can your home devices face? Read our articles:

• Trojan TV, or the new risks of malicious proxies
• Ransomware now taking aim at personal backups
• Is your TV box renting out your network?
• Is your router secretly working for foreign intelligence?
• Three common attacks on Linux in homes
• How to secure your smart home

Finding a job these days is playing on hard mode. You send your resume to a company, and a couple of minutes later, an automated rejection lands in your inbox. And then it happens again. And again. Sound familiar?

In this post, we look at how recruiting platforms work from the HR side. We also show how to use AI safely as a copy editor so you can prepare a resume for recruiters without turning it into a lifeless pile of keywords. At the end, we share a ready-made prompt to help you improve your resume’s structure and content.

Protecting your data

Before you give your resume to a chatbot, remove all sensitive information: your name, phone number, home address, email, company names, and scans of documents. Any language model you chat with can sometimes memorize personal information contained in their training data. That means there’s always a chance the AI may accidentally “learn” to give your data to other users. On top of that, even the biggest services aren’t immune to glitches and leaks. For example, last year a researcher found a bug in Meta AI that let users gain access to other people’s conversations with the chatbot by changing their request ID.

The ability to read other people’s chats sometimes isn’t even a bug. For example, it recently came to light that Grok users who clicked the Share chat button to send a conversation to a friend or to themselves were also allowing search engines to index that conversation. As a result, thousands of conversations ended up in public view. These included personal data, requests to come up with complex passwords, complaints about health problems, trade secrets, and other information the chat owners clearly never meant to publish.

So before you use any chatbot, first check its privacy policy, and then go to the settings to turn off all the features you don’t need. Most importantly, turn off training the AI on your requests. And remember the golden rule: don’t send an AI anything you wouldn’t be okay with seeing on the internet.

If you work with sensitive information all the time, the safest option is to run language models locally right on your own computer. We previously explained how to do this, using DeepSeek as an example. The same approach works with any other open-weight model.

Finally, don’t feed your personal data to chatbots from unknown developers that promise to write you a flawless resume. Often, these are just slick wrappers around popular models. And you probably won’t ever find out who actually gets access to your data, where it’s stored, or what happens to it next.

Malicious actors can use this information for follow-up attacks. For example, they can send fake interview invitations and attractive job postings that match your work experience and career interests a little too well. From there, the scam can go in many directions: a malicious file disguised as a job invitation, a link to a phishing page that steals your account, a request to install “corporate software” or to continue the chat in a messaging app, and so on.

When choosing an AI tool, ask yourself these questions:

• Does the service have a clear privacy policy?
• Does it say what happens to your file after you upload it — will it be stored or deleted?
• Does the service explain whether your data will be used to train AI?
• Who owns the service? Can you trust this company?
• Is the site protected with HTTPS?

Who reads your resume: a human or a robot?

Most large and mid-sized companies have long used an applicant tracking system (ATS). This is specialized software for HR teams (human resources specialists or, put simply, recruiters) that collects and sorts job applications.

A company having an ATS doesn’t mean their applicants are scored automatically. It’s a fairly old type of system that dates back to when artificial intelligence looked very different. Then, as AI tech evolved, some companies started building AI modules into their ATS. But how common this is varies a lot from country to country and market to market. According to a LinkedIn study, 37% of HR leaders surveyed worldwide use AI in hiring, but only 11% actively integrate AI tools into their HR platforms.

The takeaway: you can optimize your resume for AI, but you still need to write it for a human. Even if your resume clears the AI screening, an HR person will read it next — and flat, machine-sounding prose will only hurt their impression of you.

Keep in mind that instant rejections don’t come only from AI. In some ATS, recruiters can set up automatic rejection rules by hand. For example, these rules can rely on a candidate’s answers about education, work authorization, required experience, licenses and certifications, ability to work the required schedule, and so on. So take a moment to check that your resume contains up-to-date and complete information relevant to the vacancy.

How to write a resume that passes both AI and HR screening

Write the first draft yourself

It’s ok to turn to AI for help, but the resume has to have substance, and a real person with real work experience has to shine through.

Start by writing your resume yourself. It doesn’t have to be perfect, and it can have mistakes. Only then ask AI for a fresh pair of eyes. Here, AI shouldn’t act as your personal biographer. It should act as a copy editor that polishes the wording and structure.

Keep the formatting simple

Unless the employer asks for something specific, skip the photos, tables, complex graphics, and custom fonts. And definitely don’t try to design something fancy in a graphic editor. Any of these can make your document unreadable for an ATS. The gold standard is a plain PDF or DOCX file with headings, a standard font, clear sections, and bulleted lists.

Tailor your resume to each job

Copy the job description and ask a chatbot to work its key phrases into your resume. Don’t just sprinkle keywords around. Put them in context and back them up with examples from your experience. Remember: you should be able to prove every word in your resume.

Show what your effort achieved

Skip the generic phrases, personality labels, and bare lists of duties like “responsible”, “did data analysis”, or “prepared reports”. Both recruiters and AI look for specifics, ideally with numbers and timeframes. Show what you did your job for, not just what you did.

Stick to the action + tool + result formula: “Automated report generation with Python and cut preparation time by 80%”, “Launched a new pricing model and grew annual revenue from US$400 000 to US$600 000 in 12 months”, “Developed a corporate messaging app that more than a thousand employees use today”. Don’t overdo the numbers. If you don’t have exact figures, or they don’t apply, don’t make them up.

Put the most important things first

Start with a short paragraph of two to three sentences that covers the key points and contains a link to your portfolio. Use it to give a brief overview of your work experience, skills, and key achievements. If you’re new to the field, write about your education and career goals instead.

List your work experience in reverse chronological order so your latest career achievements are the first thing people see.

AI prompt

You’ve got the tips — now it’s time to ask AI for help. Here’s a prompt that works. We’ve tested it on several chatbots:

Review before sending

• Check for extraneous information: make sure your resume doesn’t include unnecessary personal data or information covered by an NDA.
• Check for readability: make sure your resume has the right headings, dates, and section order, and that the file is in DOCX or PDF format. Remove any complex graphics from the document.
• Check for accuracy: reread every statement and ask yourself, “Could I back this up in an interview?” Remember: AI doesn’t know all the details of your work and may exaggerate some of the wording.

More on how to use AI safely without compromising your privacy:

• Privacy settings in ChatGPT
• The pros and cons of AI-powered browsers
• How phishers and scammers use AI
• Hacking Black Friday: using LLMs to save on the “sale of the year”
• Would you entrust your vacation travel plans to AI?