Php
5 articles
WordPress 7.1.4 closes a no-login takeover window during core updates. Update, then lock wp-content/upgrade/
How to fix the WordPress 7.1.4 upgrade race: upgrade WordPress to 7.1.4 (or 7.0.8, 6.9.11, 6.8.12) and block web access to wp-content/upgrade/. Before 7.1.4, anyone hitting the right path mid-update could reach the unpacked installer. 21 more bugs need an account.
HOL GuardMagento PolyShell (CVE-2026-48356) is on CISA KEV: install APSB26-73, then hunt the webshells
How to fix CVE-2026-48356: upgrade Adobe Commerce or Magento Open Source to the APSB26-73 (2026-jul) release for your line, then search pub/media/custom_options for uploaded shells. CISA added PolyShell to KEV on October 27; it has been mass-exploited since March.
HOL GuardPHP2Shell is now on CISA's exploited list. Patch PHP by Oct 29 and check for a break-in before you restart (CVE-2026-109618, CVE-2026-109619)
How to fix CVE-2026-109618: upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart every worker. CISA added both PHP2Shell bugs to KEV on Oct 26 with an Oct 29 deadline and forensic triage, so save logs and the process list before the restart.
HOL GuardPHP2Shell lets attackers run code on PHP web servers with no login. Update PHP now (CVE-2026-109618, CVE-2026-109619)
How to fix CVE-2026-109618: upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart Apache and PHP-FPM. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers run code on PHP web servers with no login. PHP 8.1 and older get no upstream fix.
HOL GuardCVE-2026-38447: osTicket Generates Predictable API Keys via MD5 Hashing (CVSS 9.8)
osTicket 1.18.3 generates API keys using MD5 with predictable inputs (timestamp and client IP). An attacker can approximate the key generation time and brute-force the key space. Affects 5 million+ users and 15,000+ businesses worldwide.
HOL GuardRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.