For the past week, software engineers around the globe have been scrambling to update the backend of websites after a team ...

The PHP project shipped emergency security releases on Oct. 21 to close two critical remote code execution holes, ...

In PHP environments, two issues have simultaneously come to light that allow arbitrary code execution from the outside ...

In July 2004, security researcher Stefan Esser sent a warning.

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.

PHP2Shell refers to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could lead to unauthenticated ...

AI models uncovered what OpenAI calls "one of the most impactful" security bugs in recent memory, hidden in PHP for more than a decade. From a Pokémon sleep tracker to the Dutch parliament, websites ...

A critical security flaw in the programming language underpinning much of the web has prompted a global rush to patch ...

While researching the PHP2Shell news, I found something more concerning than the vulnerability itself.PHP is used on websites all over the world, right?Who exactly manages such an important technology ...

The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch.

Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.