The NSA says patch PHP now or take your systems offline. Here is why. A bug hiding in PHP for over ten years, turned into a full server takeover in about a week with Al. Patch is out. If your site...
For developers - just to be aware. theunderKurrent does not run via PHP.
PHP2Shell - discovered by LCFR (@lcfr_hax on X.com)
The vulnerabilities consist of:
CVE-2026-109618: corrupt process memory and execute arbitrary code Affected: upload progress, remote process memory disclosure
CVE-2026-109618: corrupt process memory and execute arbitrary code, corrupt a PHP state and execute code Affected: fatal-error backtrace use-after-free, OPcache type confusion
How it was demonstrated: pre-authentication Remote Code Execution (RCE) with major CMSs, such as: Drupal, Wordpress, and Joomla, etc.
Since th…
For developers - just to be aware. theunderKurrent does not run via PHP.
PHP2Shell - discovered by LCFR (@lcfr_hax on X.com)
The vulnerabilities consist of:
CVE-2026-109618: corrupt process memory and execute arbitrary code Affected: upload progress, remote process memory disclosure
CVE-2026-109618: corrupt process memory and execute arbitrary code, corrupt a PHP state and execute code Affected: fatal-error backtrace use-after-free, OPcache type confusion
How it was demonstrated: pre-authentication Remote Code Execution (RCE) with major CMSs, such as: Drupal, Wordpress, and Joomla, etc.
Since this is a low-level exploit and affects low-level PHP processes - pretty much any site will be affected.
A St. Louis PBS station is suing a data center provider to rescue a 70-year archive.
PBS lost 50 terrabytes of data, over the span of 70 years.
St. Louis public broadcaster Nine PBS (KETC) lost access to 50 terabytes of invaluable archival footage, spanning seven decades, when its cloud vendor, Open Source Storage (OSS), suddenly shut down and went out of business.
These unique files, contained historical records of the 1993 Great Flood, East St. Louis history, and local COVID-19 pandemic coverage, are trapped on physical servers inside a Denver data center operated by Iron Mountain.
Because the data center's contract was technically with the defunct vendor rather than the st…
PBS lost 50 terrabytes of data, over the span of 70 years.
St. Louis public broadcaster Nine PBS (KETC) lost access to 50 terabytes of invaluable archival footage, spanning seven decades, when its cloud vendor, Open Source Storage (OSS), suddenly shut down and went out of business.
These unique files, contained historical records of the 1993 Great Flood, East St. Louis history, and local COVID-19 pandemic coverage, are trapped on physical servers inside a Denver data center operated by Iron Mountain.
Because the data center's contract was technically with the defunct vendor rather than the station, Nine PBS found itself locked out of its own history, showcasing the dangerous vulnerabilities of modern cloud dependency.
To prevent the irreplaceable files from being permanently deleted or overwritten, Nine PBS filed a lawsuit against Iron Mountain in Denver District Court. Fortunately, a judge recently ruled in favor of the broadcaster, ordering Iron Mountain to cooperate and establish a pathway for data recovery with the help of a third-party expert. While this legal breakthrough offers a glimmer of hope for restoring the archive, the dispute serves as a cautionary tale for organizations that outsource their historical memories to external digital hosts without maintaining physical, localized backups.
A St. Louis PBS station is suing a data center provider to rescue a 70-year archive.
PBS lost 50 terrabytes of data, over the span of 70 years.
St. Louis public broadcaster Nine PBS (KETC) lost access to 50 terabytes of invaluable archival footage, spanning seven decades, when its cloud vendor, Open Source Storage (OSS), suddenly shut down and went out of business.
These unique files, contained historical records of the 1993 Great Flood, East St. Louis history, and local COVID-19 pandemic coverage, are trapped on physical servers inside a Denver data center operated by Iron Mountain.
Because the data center's contract was technically with the defunct vendor rather than the st…
PBS lost 50 terrabytes of data, over the span of 70 years.
St. Louis public broadcaster Nine PBS (KETC) lost access to 50 terabytes of invaluable archival footage, spanning seven decades, when its cloud vendor, Open Source Storage (OSS), suddenly shut down and went out of business.
These unique files, contained historical records of the 1993 Great Flood, East St. Louis history, and local COVID-19 pandemic coverage, are trapped on physical servers inside a Denver data center operated by Iron Mountain.
Because the data center's contract was technically with the defunct vendor rather than the station, Nine PBS found itself locked out of its own history, showcasing the dangerous vulnerabilities of modern cloud dependency.
To prevent the irreplaceable files from being permanently deleted or overwritten, Nine PBS filed a lawsuit against Iron Mountain in Denver District Court. Fortunately, a judge recently ruled in favor of the broadcaster, ordering Iron Mountain to cooperate and establish a pathway for data recovery with the help of a third-party expert. While this legal breakthrough offers a glimmer of hope for restoring the archive, the dispute serves as a cautionary tale for organizations that outsource their historical memories to external digital hosts without maintaining physical, localized backups.
