PHP2ShellAttacks began 17 Oct. Fixed builds shipped 21–22 Oct. Check your exposure

Guides

Find it. Fix it. Prove it.

The critical flaw of the moment and the common weaknesses behind most website break-ins. Each guide shows how to check your own site, how to fix it, and where the facts come from.

Critical · being exploited

PHP2Shell: the critical PHP flaw

Two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, let an attacker run commands on a server without logging in. Updating WordPress or a plugin doesn’t fix them.

Read the guide

Critical · exploited · Node, Python, .NET

Broccoli2Shell: the Brotli flaw in Node.js, Python and more

CVE-2026-111497 is a bug in the Brotli decoder: crafted compressed data writes past the end of a buffer, which can crash a process, leak memory or, on some builds, run code. It is also called Node2Shell and HTTP2Shell.

Read the guide

Critical · exploited · React, Next.js

React2Shell: remote code execution in React Server Components

CVE-2025-55182 lets an unauthenticated attacker send a crafted HTTP request that React decodes into code execution on the server. It affects apps that support React Server Components, including Next.js, even if they define no server function endpoints.

Read the guide

Common · easy to miss

End-of-life PHP: no more security fixes

Every PHP version gets two years of bug fixes, then two more of security fixes only. After that, new flaws are never fixed in that version, however serious.

Read the guide

Common · most WordPress flaws

Vulnerable WordPress plugins and themes

A WordPress site is mostly other people’s code. A flaw in one plugin can give an attacker the same access as a flaw in PHP, and WordPress won’t always warn you.

Read the guide

Common · OWASP Top 10

SQL injection

SQL injection lets an attacker change a database query through a form field or a web address. It can expose or change customer data.

Read the guide

Common · OWASP Top 10

Cross-site scripting (XSS)

Cross-site scripting lets an attacker run their own script in your visitors’ browsers, to steal logins or change what they see on your pages.

Read the guide

Common · Laravel and others

Exposed .env files and debug mode

Config files and debug pages can hand over passwords and keys. In Laravel, a debug page left on in production was exploitable for remote code execution (CVE-2021-3129).

Read the guide

Common · PHP and Node

Vulnerable Composer and npm packages

Your code includes many packages you didn’t write. A flaw in one of them is a flaw in your site, and it won’t show up unless you check.

Read the guide
Scan my site freeBook a call