Recent posts tagged php

Exploring CVE-2026-109618 and CVE-2026-109619 through a TryHackMe lab. Introduction October is Cybersecurity Awareness Month, and honestly, this month has been quite interesting from a cybersecurity perspective. There have been plenty of vulnerabi...

Originally published on the Dunimehttps://dunime.com/insights/php2shell-patch-php-now.html blog. Two critical PHP flaws let an attacker run code on a web server without logging in. What changed on 21 October, which sites it touches, and what to do t...

When a WordPress site crashes immediately after an update, the immediate business impact is lost revenue, disrupted customer workflows, and compromised search standing. In production environments, standard advice like "restore a backup from yesterday...

A single unauthenticated request can run code as your web worker on PHP before 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. The bug is real, the patch is out, and reliable exploitation outside a lab is far harder than the headlines suggest. This is the full an...

This is a 16 KB name: $row = 'Smith, ' . strrepeat'V ', 8188; new \Iliaal\NameParser\Parser->parse$row; On nameparser 1.5.0, the last version before the fix, that call takes 17.4 seconds of CPU on my i9-13950HX. On 1.7.0 it takes 0.064 seconds. Ea...

The PHP Core rule SafeLine shipped on 21 October is not a generic "block all uploads" switch. It is aimed at request features from the known chain behind CVE-2026-109618 and CVE-2026-109619. Four signs are called out in the rule note. A request that...

A SafeLine hit on the PHP Core rule is a starting point, not a closed case. CVE-2026-109618 and CVE-2026-109619 are serious because a crafted request can disturb the runtime or leave worker state behind. If the rule fires, or if the server looks wron...

The failure mode in this PHP advisory is not "we upgraded PHP." It is "we upgraded one PHP and left three others running." CVE-2026-109618 and CVE-2026-109619 are in PHP Core, so every branch on the host is its own decision. Build a table before you...

File upload is the practical entry for CVE-2026-109618. The weakness is in PHP's handling of multipart/form-data and the memory state around that parse, not in a single shopping-cart plugin. An attacker does not need a valid image. They need a reque...

Query Monitor is a free WordPress plugin by John Blackbourn. It adds a panel to the admin toolbar that shows what one page load did: database queries, hooks, HTTP calls, PHP errors and the template that rendered the page. On a WooCommerce store it an...

title: "You patched PHP. The old image is still in your cluster's future." published: false description: "PHP2Shell CVE-2026-109618, CVE-2026-109619 as seen from a Kubernetes cluster: how fast the scanners caught up, where they stay blind, and why r...

PHP shipped emergency patches on October 21 for two critical flaws now known as PHP2Shell. Both are rated 9.2 under CVSS v4.0. Both can let an unauthenticated attacker run code on your server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. ...

PHP's two critical flaws, CVE-2026-109618 and CVE-2026-109619 PHP2Shell, were patched in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The advice everywhere was to update. I want to write about something less covered: how much you can honestly claim afterwards....

If you take payments with Stripe, the money moving is only half the story. The other half arrives later as Stripe webhooks: messages that tell your app a payment succeeded, failed, was refunded or disputed. Handle them badly and you get customers who...

Every business with an ageing application eventually faces the same question: do we rewrite or refactor the legacy application? Get it wrong and you either burn a year rebuilding something that already worked, or you pour money into patching a system...

As a PHP developer, I enjoy turning ideas into functional websites and building backend solutions that solve real-world problems. For me, programming is not just about writing code; it’s about understanding challenges, finding practical solutions, an...

For 1,000 typical text emails, the model API can cost roughly $0.05 to $1.08, or about PHP 3 to PHP 66 at a rounded PHP 61.55 per US dollar. That estimate assumes 900 input tokens and 30 output tokens per message, no attachments, no retries,...