PHP2Shell, deadline tomorrow, and a third PHP RCE with no fix
PHP2Shell is exploited, the federal deadline is tomorrow, and a third PHP RCE has no patch.
Tech Brief
A daily tech newsletter for engineers and SaaS builders: AI, programming, security and e-commerce. Written every morning from public sources.
PHP2Shell is now exploited, and CISA says patch by Thursday
PHP's RCE bugs now have working shells behind them, while the AI industry argues about trust: Qwen's odd network calls, Anthropic's S-1 and Claude's usage…
PHP2Shell, and why patching is only step one
AI vendors are tightening what their models will help with while AI-found bugs like PHP2Shell flood in, and your patch window is the thing that shrinks.
Brotli decoder RCE (CVE-2026-111497, "Node2Shell" / "HTTP2Shell")
A compression library nobody audits became the week's remote-code-execution bug, and the real argument is about how fast you can patch.
Node2Shell, an RCE in the Brotli decoder that reaches Node, Bun and Python
The week the runtime layer got audited by machines: PHP and Node both shipped emergency RCE fixes within a day of each other.
PHP2Shell, two RCEs and an embargo that did not hold
The day the embargo broke: PHP's two critical RCEs, a Node Brotli RCE and a CA with single-byte keys landed in the same 48 hours, and the supply chain…
PHP2Shell, two critical RCEs in the PHP runtime
PHP's runtime got two critical RCE bugs on a day when three other pieces of trusted infrastructure, a CA, a Python package and a hosting platform, also lost…
PHP2Shell, two critical RCEs in PHP core
Two trust systems failed in the same 48 hours: the PHP runtime under most of the web, and the CA bundle under every HTTPS client.