TL;DR Recent cyber-attacks in October 2026 brought multiple serious incidents, most notably PHP2Shell: two critical flaws in the PHP programming language that attackers actively exploited. AI is helping find vulnerabilities quicker, but attackers can weaponise them faster than they can be fixed. Make sure your site runs a current, patched PHP version, keep your plugins updated, and regularly test backups. KEY TAKEAWAYS PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers execute code on unpatched servers without logging in. Fixes are available in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The US cybersecurity agency CISA confirmed active exploitation on 26 October 2026. Attackers attempted exploitation before the flaw […]