PHP2Shell will persist in enterprise environments for years

Two critical vulnerabilities were announced last week in PHP, the internet’s most widely used web application runtime, and they came with the familiar warning to patch immediately. But CISOs will have to deal with the long tail of these flaws for years due to widespread PHP integration into third-party products with patching cycles customers don’t control. NAS devices, firewalls, VPN gateways, printers, building mana…

Vulnerabilities & Zero-Day Cloud Security AI Security Supply Chain Security IoT & OT Security Web Development Cloud Computing Networking & Internet Operating Systems Hardware & Chips Incident Response & Forensics Identity & Access Security
Read the full article at CSO Online Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →
Check Point Blog

HTTP2Shell: The Brotli Vulnerability That Extends Beyond Node.js

The key point: CVE-2026-111497 now increasingly referred to as HTTP2Shell and initially reported as Node2Shell, is broader than a Node.js vulnerability. The vulnerability is associated with Brotli decompression, so defenders need to find vulnerable implementations across applications and infrastructure, confirm whether untrusted compressed data can reach them, and patch the affected component. AT A GLANCE · CVE: CVE-…