https://blog.kalfaoglu.net/tags/plesk/Recent content in Plesk on kalfaoglu.netHugoenSun, 25 Oct 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-10-25-php2shell-cve-2026-109618-109619-en/Sun, 25 Oct 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-10-25-php2shell-cve-2026-109618-109619-en/<p>On 21 October 2026, the PHP security team shipped patches for two critical remote code execution vulnerabilities, collectively dubbed <strong>PHP2Shell</strong> by the researcher who found the exploit chain, Kirill Firsov. Both flaws carry a CVSSv4.0 score of 9.2. Both are exploitable before any application code runs, with no authentication required.</p> <p>If your server runs PHP to handle web requests — and it almost certainly does — patch now.</p> <h2 id="what-is-actually-broken">What is actually broken</h2> <p><strong><a href="https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/">CVE-2026-109618 — OOM Corruption</a></strong></p>