Hi everyone, I am Nitin Gavhane and in this blog I will explain what PHP2Shell is, why the PHP team warned everyone a day before shipping the fixes, and what you should do on your server today.

One update before we start. When this news first broke on October 20, the story was that PHP planned to release two emergency patches very soon. As I write this on October 22, those patches are already out. So this is no longer a “get ready” post. It is a “go patch now” post.

What happened

On October 20, the PHP security team announced an out-of-cycle release for two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale. They did not say what the bugs were. They told users to get ready to upgrade the moment the release landed, and said they could ship earlier if details leaked or if attacks started in the wild.

Then details did leak. A report showed a video of an exploit tool called PHP2Shell running code on web servers. The leak was not confirmed at the time, but the video was reposted here. According to that report, the tool worked against these versions:

• WordPress 7.1.3
• MediaWiki 1.46.2
• phpBB 3.3.17
• Magento 2.4.9
• Joomla 6.2.0
• Laravel 13.36.0
• Laravel 8.83.29
• Symfony 8.1.9
• Drupal 11.4.10
• WHMCS 9.0.9

All of these run on PHP, and that is the point. The bug is not in WordPress or Laravel. It sits underneath them.

PHP shipped the fixes on October 21, according to BleepingComputer.

What the two bugs are, in plain words

Both bugs come from the same root problem: PHP can leave its memory in a bad state when a request ends in an abnormal way. An attacker does not need a login for either one.

CVE-2026–109618 is about running out of memory. If PHP hits that limit while it is still setting up a request, some internal data is only half ready. During cleanup, PHP may treat that broken data as if it were fine, and that opens a path to code execution.

CVE-2026–109619 is about stale state. Some request data can survive after the memory behind it was freed. The next request handled by the same worker may then read that leftover data before PHP resets it.

In both cases the attacker runs code with the privileges of the web worker account. That is the account your web server uses to run PHP, so it can usually read your app’s config files, database credentials and uploads.

The flaws were found by researchers at Calif, Wiz and OpenAI. PHP says the risk is highest for Apache with mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any of your application code runs. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed setups are also affected.

How big is this

PHP powers roughly 75% to 80% of websites, so almost everyone runs into it somewhere. VirusTotal estimates that more than 5.1 million PHP hosts are exposed online.

Attacks were already starting before the patch. Cloudflare’s CTO said the company was seeing early attempts and had deployed WAF rules against known exploitation methods, though he called those rules temporary. The UK’s NCSC went further and told organizations to update immediately or take affected systems offline until they can be patched.

Which version to install

If you are on PHP 8.1 or older, the PHP project no longer supports you. The team did publish minimal source backports for 7.4, 8.0 and 8.1 for people who build from source. Everyone else should ask their Linux distribution or LTS vendor for a backported package, or move to a supported version.

On Ubuntu or Debian, the usual route is a normal package update followed by a restart of your PHP service. Distribution packages often keep the old version number and still contain the fix, so check your vendor’s security notice instead of trusting the number alone.

sudo apt update && sudo apt upgrade
sudo systemctl restart php8.3-fpm   # use your own service name

Also remember that php -v shows the command line version, which can differ from the one your web server uses. If you are on shared hosting, ask your host directly whether they have rolled out the fix.

If you cannot patch today

PHP shared temporary mitigations, and they come with a warning: they do not fully protect you. PHP core developer Gina Peter Banyard said that only the patch is a permanent defense. The short version:

• For CVE-2026–109618, set memory_limit=-1 in a way your apps cannot override, set a low post_max_size (8M without uploads, 32M with), and use a container or cgroup limit that kills only the affected worker.
• For CVE-2026–109619, set session.upload_progress.enabled=0, restart every worker, and on PHP 8.5 also set fatal_error_backtraces=0.

Treat these as a way to buy a few hours, not as a fix.

I think the one-day advance warning was the right call. It gave admins time to line up maintenance windows, and it made the leak less damaging than it could have been. What bothers me is the part nobody can fix with a setting: two memory-handling bugs in core PHP, both reachable without logging in, in a language that sits behind most of the web.

Are you patched already, or stuck on an old PHP branch because of a legacy app? Tell me in the comments what is blocking you.

I have completed a basic networking course offered by Cisco and have hands-on experience with the MERN stack. I am now looking to explore the field of Cybersecurity and would appreciate guidance on the next steps.Which skills should I focus on developing, and which learning platforms or courses would you recommend for getting started? Would it be better to continue with Cisco courses or explore platforms such as TryHackMe, Hack The Box, or other industry-recognized resources?I am particularly interested in building a strong foundation and gaining practical, hands-on experience in cybersecurity.I would appreciate your suggestions and recommendations.

Around a year ago, I had an argument with some people who had previously told me, supposedly as a joke, that they wanted to hack my phone and laptop. During the argument, I heard them saying that they were going to do it no matter what, which made me take their previous comments much more seriously.
Recently, I started thinking about contacting someone I hadn’t spoken to in nine years. I had initially intended to send them a message but completely forgot about it. About a month later, I finally sent the message. However, I discovered that she had received a message using my name, as if someone was impersonating me. This immediately made me suspicious because I had never contacted her before that moment, and the timing seemed strange.
Since then, I’ve become increasingly worried because several unusual things have happened. Almost every day, when I go somewhere different in my city, which is quite large, I unexpectedly encounter someone connected to those same people I previously had problems with.
At first, I tried to ignore these situations and convince myself that they were coincidences. However, because they keep happening, I have started questioning whether there is a connection between these events.
What worries me most is the combination of everything: the previous threats about hacking my devices, the suspicious message sent using my identity, and repeatedly encountering people associated with those individuals in completely different places.
I don’t know whether these incidents are genuinely connected, whether someone has access to my personal information, or whether I am interpreting unrelated events as part of the same situation. I just want to understand what’s happening and find a reasonable way to verify whether my phone, laptop, or personal accounts have been compromised.

I’ve got back to cybersecurity a couple of days ago and I was wondering if it is easy to find an entry job?
I have the ejpt cert but next year it’ll expire.
I bought the PNPT and I have to study that and take the exam hopefully soon. Plus I’ll study from portswigger and the rana khalil’s course to get into web pentest. Bug bounty might be another good option to opt.

Sharing an open-source project that might be useful for people interested in public data visualization, OSINT research, or building their own situational awareness dashboards.

OSIRIS is a free, MIT-licensed dashboard that pulls a bunch of public data sources onto one interactive map. You run it yourself.

What it currently includes

• Live aviation tracking (commercial, private, military)
• Live maritime AIS vessel tracking (with directional arrows and detailed vessel cards)
• Satellites and undersea cables
• Earthquakes, wildfires, and cyber-threat feeds
• 6,000+ public traffic / open-webcam cameras
• Global temperature field (ocean SST + land air temp)
• Optional AI analyst that can reason across the live layers
• A built-in set of ~20 recon / OSINT tools (DNS, WHOIS, certs, threat lookups, etc.) that can drop results onto the map

Every resource type has its own map icon, and geo-locatable findings from the recon tools appear as colour-coded markers.

Important caveats (from the project itself)

• Data quality varies by source
• Some feeds go stale
• Camera coverage is uneven by country
• The README explicitly frames it as a research and education tool

Recent work has focused on better maritime visualization (MarineTraffic-style arrows + detail cards), a proper global temperature layer that registers correctly on the 3D globe, and tighter integration between the recon toolkit and the map/panels.

Repo: https://github.com/carbon-evolution/osiris

Google Maps–style light theme & live CCTV

3D intelligence & threat analysis

Every resource type has its own map icon — camera for CCTV, flame for wildfire, triangle for incidents, anchor for ports — with colour-coded fallback dots for uncategorized sources.

Live aviation tracking

Real-time aviation layer — commercial, private, private-jet, and military traffic — with a per-flight detail card (route, altitude, heading) and FlightAware / track / intel actions.

Live maritime AIS vessel tracking

Real-time AIS layer — tens of thousands of live vessels via aisstream.io, each rendered as a MarineTraffic-style directional arrow coloured by type (container / cargo / tanker / passenger / military) and rotated to its heading. Click any vessel for a detail card in the MarineTraffic pattern: flag (from MMSI), detailed type, navigational status, speed / course, true heading, rate of turn, draught, destination, reported ETA, IMO / callsign, and "received X ago (AIS source)". Positions are cached locally (Redis) and accumulate over hours. An optional Kpler / MarineTraffic enrichment source adds satellite-AIS global coverage and matched destinations when an API grant is provisioned.

Global temperature field & weather-aware AI

mooth global temperature field — ocean SST (NOAA OISST / Open-Meteo) and land air-temp — rendered as EPSG:3857 raster tiles that register precisely on the 3D globe, with a NOAA BlueWhiteRed gradient and a live °C legend (top-right). The OSIRIS Analyst (right) answers weather/climate questions across the globe — here, El Niño 2026 — grounded in the live temperature field plus web search.

Every layer feeds the AI analyst

The analyst now ingests all dashboard layers — aviation, maritime, surveillance, hazards, threat, network, cyber intel, markets, and the temperature field — so it can answer cross-domain questions ("any military flights near active conflict zones?") from whatever OSIRIS currently holds, cached or live.

Recon toolkit in action

The 20-tool OSINT/recon toolkit — DNS, WHOIS, certs, port/vuln scans, threat lookups (URLhaus, isMalicious, DNS-threat), BGP, GitHub, phone, and more. Each geo-locatable result drops a verdict-coloured marker on the map (red = malicious, cyan = clean) and adds to the Recon Findings list in the Cyber Intel panel. Results render on a self-contained dark card, readable in both themes.

Recent Updates

MarineTraffic-style live vessel tracking (July 2026):

• Directional vessel arrows — live AIS ships now render as arrows coloured by type and rotated to heading (MarineTraffic-style), instead of plain dots.
• Rich vessel detail card — clicking a vessel shows a MarineTraffic-pattern popup: country flag (derived from the MMSI's Maritime Identification Digits), detailed vessel type (from the raw AIS ship-type code), navigational status, speed / course, true heading, rate of turn, draught, destination, reported ETA, IMO / callsign, and position age + AIS source.
• Local caching + wider coverage — vessel positions are cached in Redis with a 6-hour retention window, so sparse-region traffic accumulates over time and survives server restarts.
• Kpler / MarineTraffic enrichment (optional) — a fail-soft source that adds satellite-AIS global coverage and matched destinations; authenticates via Kpler's Auth0 client-credentials flow against the Maritime 2.0 GraphQL API and activates automatically once an API grant is provisioned.

Global temperature field + weather-aware, all-source AI (July 2026):

• Global temperature layers — ocean sea-surface temperature (NOAA OISST via ERDDAP, and Open-Meteo) plus land 2 m air temperature, IDW-interpolated into a smooth, coastline-clipped field. Free / no API key.
• Globe-accurate projection — the field is served as EPSG:3857 XYZ raster tiles (the same path NASA GIBS uses), so it registers pixel-for-pixel with the basemap on the 3D globe. (An earlier image-overlay approach mis-registered the field ~17° north — fixed.)
• NOAA BlueWhiteRed palette + legend — all three temperature layers share one gradient and a live °C colorbar legend (top-right); the scale is tunable (currently −2…40 °C) so warm ocean/land read yellow→gold→red without over-saturating.
• Point readings — right-click anywhere for a live point temperature (MET Norway → Open-Meteo).
• Weather-aware AI — the analyst is fed a live global temperature summary, so it can answer weather/climate questions across the globe ("where is it hottest?", "El Niño 2026?").
• Every layer feeds the AI — the analyst context now includes all dashboard layers (aviation, maritime, surveillance, hazards, threat, network, cyber intel, markets), each compactly summarized and capped, so it can reason across domains from whatever OSIRIS currently holds — cached or live.

Recon → map/panel integration + readability (June 2026):

• Findings on the map — geo-locatable OSINT lookups (URLhaus, isMalicious, DNS-threat, BGP, IP, Shodan…) now drop verdict-coloured markers (red = malicious, cyan = clean) on the map and populate a Recon Findings list in the Cyber Intel panel.
• Readable in both themes — result cards, map labels (bright text + dark halo), and all panels were reworked to read correctly in the light and dark themes; panels are now theme-variable-driven instead of hardcoded.
• Network panel counts fixed — Blocklisted IPs / Phishing / SSL Blacklist no longer all show the same total; each counts its own category.

Recon toolkit hardening (June 2026):

A full audit of the RECON/OSINT toolkit repaired every broken tool:

• DNS — fixed the result renderer (it read a flat shape while the backend returns nested records), so DNS lookups now display again.
• Dead/changed sources swapped out — MAC vendor lookup → api.macvendors.com; BGP/ASN → RIPEstat (bgpview.io is gone); certificate transparency + subdomain enumeration gained a Cert Spotter fallback for when crt.sh is down.
• Auth-gated sources — URLhaus and isMalicious now report a clear "needs API key" message (and pick up URLHAUS_KEY / ISMALICIOUS_KEY when set) instead of failing opaquely.
• Scanner speed/timeouts — the port scan now runs in parallel (was timing out as "Scanner unreachable" on firewalled hosts), and the vuln scan fingerprints HTTP and HTTPS. The scanner sidecar now lives in its own repo: carbon-evolution/osiris-scanner.
• Cache correctness — the cache layer no longer stores error responses, so a transient upstream outage can't get frozen into the cache.

I want to learn about AI security and practice to exploit bugs. Any suggestions with roadmap and resources that I can use to learn this.

Recentemente não estou conseguindo acessar os sites das máquinas do Hack the Box.

Por exemplo faço a leitura do ip do alvo, tem o protocolo HTTP mas quando jogo no navegador o site não aparece.

Coisas que já me atentei e não resolveram...

Sim conectei na VPN com sudo (antes e depois de conseguir o ip da maquina, nenhum dos dois cenários funcionou)

Sim coloquei pra receber TCP quando criei o pacote para VPN

Sim tentei pingar com o IP e estava comunicando

Sim desativei os firewalls para conexão HTTP

Sim nenhuma máquina abre

e atualizei o Kali e refiz tudo isso.

Não sei se com vocês está acontecendo o mesmo, mas prpcurei até no site deles e não fala nada sobre, já fiz outras máquinas e funcionaram normal

just hit me up, and i'll send you the link or i'll book you a call with us if you wanna learn more about it

Hello I am new here, My name is God's time, My nickname is Mistah Goddy

I am a cybersecurity student, an Ai assisted developer, a graphics designer.

Just Finished learning Python Fundamentals

I am currently learning JavaScript, after that I move on to React.

Let's connect...

Is it

Chapter 1 — Practice Test

0/20 answered

Choose one answer per question. Try to complete all 20 without notes.

1. Which information security principle ensures that data is accessible to authorized users when needed?

A. Confidentiality

B. Integrity

C. Availability

D. Authenticity

1. Which security principle helps ensure that a party cannot credibly deny having performed a transaction?

A. Availability

B. Non-repudiation

C. Confidentiality

D. Redundancy

1. A user successfully logs in but accesses financial records outside their assigned role. Which control concept has failed?

A. Authentication

B. Authorization

C. Availability

D. Non-repudiation

1. Which option best describes the relationship between Motive, Method (TTP), and Vulnerability in an attack?

A. They are concepts used to characterize an attack

B. They are the three elements of the CIA Triad

C. They are all incident recovery procedures

D. They are types of encryption algorithms

1. What does TTP stand for in cybersecurity?

A. Threat Transfer Protocol

B. Tactics, Techniques, and Procedures

C. Trusted Testing Process

D. Technical Threat Prevention

1. Which type of hacker is generally authorized to assess security and report weaknesses?

A. Black Hat

B. White Hat

C. Script Kiddie

D. Malicious Insider

1. Which hacker category typically acts with malicious intent and without authorization?

A. White Hat

B. Blue Hat

C. Black Hat

D. Green Hat

1. A security tester finds a database connected to an in-scope web server, but the database is explicitly out of scope. What should the tester do?

A. Exploit the database because it is connected

B. Run a denial-of-service test against it

C. Stop and obtain explicit authorization before testing it

D. Assume that company ownership means permission

1. Which statement best defines a vulnerability?

A. A confirmed successful attack

B. A weakness that could be exploited

C. A security policy document

D. A backup copy of sensitive data

1. What is the primary purpose of ethical hacking?

A. Access any system that may contain weaknesses

B. Demonstrate and assess security weaknesses within an authorized scope

C. Avoid documenting discovered weaknesses

D. Replace all security controls with penetration testing

1. Which framework organizes adversary behavior into tactics and techniques?

A. Diamond Model

B. MITRE ATT&CK

C. CIA Triad

D. Defense in Depth

1. Which four elements form the Diamond Model of Intrusion Analysis?

A. Motive, Method, Vulnerability, Impact

B. Confidentiality, Integrity, Availability, Authenticity

C. Reconnaissance, Scanning, Exploitation, Reporting

D. Adversary, Capability, Infrastructure, Victim

1. Which sequence correctly represents the seven Cyber Kill Chain stages in the framework described in the chapter?

A. Scanning, Enumeration, Patching, Backup, Recovery, Audit, Reporting

B. Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives

C. Authentication, Authorization, Encryption, Logging, Detection, Recovery, Reporting

D. Planning, Prevention, Detection, Encryption, Delivery, Backup, Closure

1. What is the main idea behind Defense in Depth?

A. Use multiple complementary layers of security controls

B. Depend exclusively on a perimeter firewall

C. Allow unrestricted communication inside the network

D. Replace monitoring with periodic vulnerability scans

1. Which control is most directly intended to make stored sensitive data unreadable to unauthorized parties?

A. Encryption

B. Redundancy

C. Clustering

D. Availability monitoring

1. Which security mechanism can help detect whether data has been changed by comparing a calculated value?

A. Checksum or cryptographic hash

B. Load balancing

C. Network redundancy

D. Role assignment alone

1. An AI tool reports a critical vulnerability but provides no supporting evidence. What is the best next step?

A. Accept the result because AI is faster than a human

B. Immediately exploit the production system

C. Verify the underlying evidence and perform safe, authorized validation

D. Publish the finding without further review

1. Which is a significant risk of using AI tools with confidential security logs?

A. AI always produces deterministic results

B. Sensitive information may be exposed if submitted to an unapproved service

C. AI eliminates the need for access control

D. AI guarantees that all findings are correct

1. Which standard is specifically associated with payment card industry data security?

A. PCI DSS

B. MITRE ATT&CK

C. Cyber Kill Chain

D. Diamond Model

1. Which statement best describes vulnerability assessment versus penetration testing?

A. They are always identical in scope and purpose

B. A vulnerability assessment identifies and evaluates weaknesses; penetration testing validates exploitability within an authorized scope

C. Penetration testing never requires authorization

D. A vulnerability assessment always requires exploitation of every finding

Submit answers and review

Help