Posts tagged "php"

2posts

November 3, 2026

HTTP2Shell: the Brotli vulnerability that also hits WordPress

HTTP2Shell (CVE-2026-111497, CVSS 9.2) is a Brotli decoder bug that Wordfence exploited in the lab against WordPress via XML-RPC pingbacks, even on patched PHP 8.3.36. Who is exposed, how to check and how to fix it.

#wordpress #security #php

The word PHP cracked and struck by lightning on a dark blue background

October 21, 2026

PHP2Shell: two critical PHP vulnerabilities, update now

PHP2Shell: two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) allowing unauthenticated RCE. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35: who is exposed, how to update and what to do if you can't.

#php #security #wordpress