Official company update
PHP2Shell: One Upload, Full Server
Publisher preview
How many servers are one malformed upload away from leaking your secrets? PHP2Shell is a pair of critical flaws that let unauthenticated attackers run code remotely on PHP installations serving web requests. Because PHP runs roughly 70% of the world’s websites and the bugs fire before any application code executes, even a fully patched WordPress, Drupal, or Joomla site is exposed until the PHP underneath is updated, and attackers are probing for it. Calif, a security research firm working under OpenAI’s Patch the Planet initiative, found the bugs first on August 1 and reported them to PHP on August 11. Wiz Research found them separately. - Two critical flaws in PHP itself. CVE-2026-109618 and CVE-2026-109619 sit in the core engine, so even secure application code can’t protect a vulnerable server. An unauthenticated remote attacker can read a PHP worker’s memory (passwords, tokens, API keys) and, in some cases, run code on the server.
A saved ApplyDjinn digest is not available for this story yet.
This preview is supplied by the publisher. The complete publication remains at its original source.
Request a correction or removalApplyDjinn context
What else is visible for Varonis?
These are observations in our catalog around the company, not claims made by the article. A publication does not establish why hiring, search interest, or share prices moved.
Current roles
62
30-day current-market scope
Company stories · 30d
10
10 official · 0 independent
Attention records · 7d
0
0 Google · 0 Polymarket
Coverage mix
Attention sources
No matching record in this window.
Open roles
62
VRNS share
$48.85
30-day share move
+3.0%
Hiring and market history
Daily vacancy snapshots and closing share prices are independent signals.
Vacancy history
VRNS closing price
Share price is shown for context, not as company-size or investment advice.
Vacancy history uses saved daily snapshots through 2026-11-02. News counts are dated publications; attention counts are matched records, not search volume or prediction probabilities.