Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost
The root-cause fix will take weeks; protection can't wait.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Hunt or be Hunted: HuntIQ Hunters Take on php2shell
Learn how Tanium put a fleet-wide PHP inventory in every Tanium Cloud tenant about eight hours after PHP shipped its php2shell fix.
Explaining PHP2Shell | Arctic Wolf Threat Brief
In this explainer from Arctic Wolf's Peter Ingebrigtsen, we break down what the PHP2Shell vulnerabilities are, how attackers are exploiting them, and the steps organizations should take now to reduce exposure. Arctic Wolf customers can use Aurora Exposure Management to identify affected assets and prioritize remediation, while the Aurora Agentic SOC helps detect and respond to post-exploitation activity such as webshell deployment, unauthorized command execution, persistence, and lateral movement.
OWASP Top 10 Kubernetes Security Risks Explained: Why Credentials Deserve a Closer Look
GitGuardian researchers reached 44 active Kubernetes clusters through leaked secrets, and 30% had been exposed for more than two years. Here’s how the OWASP Kubernetes Top 10 explains these Kubernetes security risks, and why K03, Secrets Management Failures, turns one leak into a chain.
How to patch PHP2Shell with free Aikido Images
PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started. PHP shipped fixes on October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are out of support and won’t get an upstream release.
PHP2Shell Is a Wake-Up Call for Every Business Leader
AI is changing how vulnerabilities are discovered and exploited for defenders and attackers alike, and the practical effect is that the time organizations have between a flaw being found and a flaw being exploited keeps shrinking. Today, we have more known vulnerabilities than at any point in history, and they’re being exploited faster than ever.
Handling PHP2Shell with Tanium Atlas: Tanium Tech Talks #175
PHP2Shell is here. See how Tanium finds PHP across your environment, scopes your exposure, and maps attack paths so you know what to patch first. In this special edition, we walk through how Tanium gives you visibility into the new PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and the resources available to help you respond.
PHP2Shell Breaks the Internet - The 443 Podcast - Episode 393
This week on the podcast, we dive into a pair of PHP vulnerabilities dubbed PHP2Shell and the chaos they caused through uncoordinated disclosure. After that, we discuss a certificate authority who's random number generator only goes to three digits before ending with law enforcement action around ShinyHunters ransomware negotiators.
PHP2Shell and the end of the once-a-year pen test
On October 21, 2026, PHP shipped emergency fixes for two flaws that let anyone on the internet run code on a PHP web server, with no login. The weakness behind them had been flagged in 2024 and then sat, partly because nobody had proved it was exploitable. In 2026, researchers working with AI models proved it within days. Exploit attempts started before the fix shipped, and details leaked a day ahead of schedule. That sequence is the real story of PHP2Shell. The bug matters, but speed matters more.
HTTP2Shell: Find and Fix Vulnerable Brotli Copies with Tanium
If you run Node.js, update to 26.12.1, 24.22.1 or 22.23.4 now. If you run Python, upgrade the Brotli package to 1.2.1 and brotlicffi to 1.2.1.0. If you run Bun, move to 1.4.4. All three carry a fix for CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder that can let a remote, unauthenticated attacker crash a process, read its memory or potentially run code by sending it crafted compressed data. Google's CVE record scores it 9.2 under CVSS v4.0.