PHP2Shell: CVE-2026–109618 and CVE-2026–109619

WatchGuard details Overlord RAT attacks using fake Brazilian legal notices, plus Lampion malware and a separate remote access campaign targeting users in Portugal.

An expert PortSwigger lab, and the five walls I hit before it cracked.

PHP2Shell shows how AI is changing the economics of exploitation, and why application defense must learn, reason, and adapt at machine…

I went looking for a use-after-free that survived PHP’s October 2026 patches. I found one. Then a control test revealed something more…

Hello, welcome to a fool’s guide to cybersecurity today, we’re talking about two critical flaws within PHP. Two critical vulnerabilities…

You do not need a lab. You need two computers and a Wi-Fi router you own.

Introduction

How I read the vulnerable PHP source, triggered the OOM condition by hand, found the one-line patch and learned why the runtime is the…

PHP released fixes for CVE-2026–109618 (memory corruption when PHP runs out of memory) and CVE-2026–109619 (use-after-free in request…

A beginner’s notes on how mobile apps are tested for security problems, and the tools testers use.

Room access: https://tryhackme.com/room/justlooking

When I started learning cybersecurity, I assumed that completing a beginner learning path would mean learning everything from scratch.

A detailed guide on how to exploit the Solmagorn machine on TryHackMe, covering the stages of initial access and privilege escalation.

Understanding CVE-2026–109618 and CVE-2026–109619, available security patches, and an open-source assessment tool developed by Grupo Oruss.

A short writeup of a bulk-harvestable metadata leak, how I found it, and what it says about the way we publish documents.