Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can allow unauthenticated attackers to execute code on affected web servers. Both carry a CVSS v4.0 score of 9.2, and exploitation attempts are already being observed in the wild.

PHP has released the following fixed versions:

PHP branch
Fixed version

PHP 8.5
8.5.12

PHP 8.4
8.4.27

PHP 8.3
8.3.36

PHP 8.2
8.2.35

If you manage your own server or VPS, install the appropriate update immediately.

Continue reading Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619) at Sucuri Blog.

Web shells are malicious scripts that give attackers persistent access to compromised web servers, enabling them to execute commands and control the server remotely. These scripts exploit vulnerabilities like SQL injection, remote file inclusion (RFI), and cross-site scripting (XSS) to gain entry.

Once deployed, web shells allow attackers to manipulate the server, leading to data theft, website defacement, or serving as a launchpad for further attacks. They are especially dangerous because they are also a post-compromise access mechanism (backdoor) rather than a standalone infection.

Continue reading Web Shells: Types, Mitigation & Removal at Sucuri Blog.