https://pixelotes.com/tags/php/Recent content in php on Raúl PastorHugoenTue, 27 Oct 2026 09:30:00 +0100https://pixelotes.com/blog/php2shell/Sat, 24 Oct 2026 11:15:00 +0200https://pixelotes.com/blog/php2shell/<h2 id="in-one-paragraph">In one paragraph</h2> <p>Two flaws in the PHP engine, nicknamed <strong>PHP2Shell</strong>, let an unauthenticated attacker run commands on a server just by sending a crafted HTTP request. They trigger while PHP parses the request, <strong>before your application code runs</strong>, so it does not matter which framework or CMS you use or how well it is written. Exploitation attempts were seen four days before disclosure. Both CVEs are rated 9.2 (CVSS v4.0) and are in CISA&rsquo;s Known Exploited Vulnerabilities catalog.</p>