PHP2Shell CVEs: Immediate Patch Required for PHP 8.2.x and 8.3.x
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution in PHP 8.2.x and 8.3.x. PHP is used by approximately 75% of all websites.
web security
3 stories
Magento Stores Hit by Scanner-Evasion JavaScript Loader Campaign
A threat actor infected 953 Magento stores with a scanner-evading JavaScript loader that serves malicious code to real shoppers while hiding from security.
WordPress Click2Shell vulnerability Enables Forced Theme Install and Remote Code Execution
The newly disclosed WordPress Click2Shell vulnerability lets attackers auto-install a theme via a crafted URL and, when chained with a vulnerable theme.