Special Report: PHP2Shell puts 70% of web at risk
Cybersecurity Today

Special Report: PHP2Shell puts 70% of web at risk

B2Upper-intermediateOctober 21, 202612 min
  • Technology

PHP2Shell: Emergency PHP RCE Patches, Leaks, and Early Exploitation (CVE-2026-109618/109619) In a special edition of Cybersecurity Today, host David Shipley covers emergency PHP patches for two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP 5.4+ and essentially all PHP deployments serving web requests across major stacks. He explains the shared root cause involving corrupted memory after abnormal request termination, outlines the fixed releases (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35), and notes no official updates for PHP 8.1 and older beyond limited source backports. Mitigations and Cloudflare WAF rules are described as partial, with patching urged...

Play episode

Opens the player: the full transcript, every word clickable, with translation and flashcards.

Try it: tap any word

Real sentences from the start of this episode. Every word is marked with its level.

Sentence 7 of 12 · 0:23

Yesterday, the PHP security team shipped emergency patches for two critical remote code execution

.

tracked as CVE-2026-1096-18 and CVE-2026-109-619.

Hear this sentence

Tap a word to see its meaning in your language.

Do you know these words?

8 harder words from this episode. Tap one to see what it means, then mark it.

  • B20:23
  • C11:35
  • B23:51
  • C16:09
  • C16:38
  • C18:38
  • B210:39
  • C111:10

Mark a few words and we'll tell you how this episode fits your level.

Is this episode right for you?

B2

B2 · Upper-intermediate

Comfortable if you already follow TV news

A1 25%A2 42%B1 23%B2 10%C1 0%
  • 90% of the words are B1 or easier.
  • 130 words a minute: a natural pace.
  • 78 harder words (B2 and up) in the whole episode.

Transcript

The opening of the episode. The whole transcript is in the player.

0:00

This is Cybersecurity Today for Thursday, October 22nd, 2026, and I'm your host, David Shipley. Let's get started. Welcome to a special edition of Cybersecurity Today.

0:13

The whole show today is about one story. Yesterday, the PHP security team shipped emergency patches for two critical remote code execution flaws in PHP itself. tracked as CVE-2026-1096-18 and CVE-2026-109-619.

0:37

PHP runs underneath summers between 70 and 80% of the websites whose server-side language is known. That includes WordPress, Drupal, Joomla, Magento, and L'Araval, among many others. PHP is the engine that powers much of the modern web.

That was the opening. The rest of the episode (11 min) is in the player: every word clickable, with translation, saved words and flashcards.

Continue in the player

Automatically generated from the audio. May contain errors. Audio belongs to its publisher and is played from their feed. Rights holders can request removal — copyright & takedown policy