https://jpcercal.com/en/tags/devops/Recent content in Devops on jpcercal.comHugoenWed, 21 Oct 2026 00:00:00 +0000https://jpcercal.com/en/php2shell-two-critical-php-vulnerabilities/Wed, 21 Oct 2026 00:00:00 +0000https://jpcercal.com/en/php2shell-two-critical-php-vulnerabilities/<p>Two critical flaws in the PHP runtime itself were disclosed on October 21, 2026: CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell.” Both are CVSS 9.2 (v4.0) and can lead to unauthenticated remote code execution. Disclosure was moved up a day after the IDs leaked (<a href="https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/">PHP Foundation</a>). The bug is in PHP core, so your framework does not matter.</p> <p><strong>The short version:</strong> update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart every worker, and verify the running version. A WAF buys time; it is not a patch.</p>