The U.S. Cybersecurity and Infrastructure Security Agency added two critical PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog. These flaws, tracked as PHP2Shell, allow unprivileged attackers to achieve remote code execution on unpatched systems. The PHP security team released patches on October 21, 2026, after urging immediate installation. Federal agencies were ordered to secure their systems by Thursday under Binding Operational Directive 26-04, while CISA encourages all organizations to prioritize remediation.
Read the full story at bleepingcomputer.com.
Photo: Pexels / Pixabay
