PHP2Shell Update: Exploitation Began Before Disclosure
AWS saw PHP2Shell attempts before disclosure. Here is what defenders now know about exploitation, memory disclosure, patch verification, and compromise hunting.
Linux Security
6 articles
PHP's Emergency Security Release: What Determines Your Exposure?
PHP has patched CVE-2026-109618 and CVE-2026-109619. Understand confirmed attack paths, fixed versions, and the limits of temporary mitigations.
ClingSTUN: Linux Backdoor Uses Public STUN Servers After IoT Exploitation
ClingSTUN turns vulnerable Linux devices into proxy backdoors. Learn what STUN traffic proves, which persistence traces matter, and how to close the entry points.
PostGREShell CVE-2026-6471: When Replication Privilege Becomes Server Code Execution
CVE-2026-6471 lets a PostgreSQL role with REPLICATION privilege load an arbitrary logical-decoding plugin. The official severity is high, the prerequisites matter, and supported releases are fixed.
TONTOU: The Interrupt That Reopens Spectre's Closed Door
MIT researchers used precisely timed interrupts to re-poison branch prediction after Spectre v2 defenses ran. The result changes risk decisions for shared Linux compute.
NGINX's Configuration-Dependent Vulnerabilities: Why Version Scanning Is Not Enough
NGINX 1.30.4 and 1.31.3 fixed three new memory-safety flaws, but exposure depends on map, slice, SSI, proxy, and buffering configuration. Here is how to audit the real path.