Threat feed

We follow new vulnerabilities in PHP, WordPress and popular software and break them down briefly: what happened, who is affected, how to check and fix. For some threats Shield can check your site from outside; for the rest we say plainly that you can only check on your own server.

All 75 Articles 43 News 32 Threats 1

Critical

PHP2Shell: a critical flaw in PHP itself (CVE-2026-109618, CVE-2026-109619)

On October 21 the PHP project shipped an out-of-band update: two bugs in the interpreter itself can, in some setups, let an attacker run code on the server without logging in. Rated 9.2 out of 10, and public exploits already exist.

21.10.2026