“The PHP panic has not turned to patching: And that’s bad news, capital B, as PHP2Shell attacks ramp up.We know the paired PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, aka PHP2Shell, have a Common Vulnerability Scoring System (CVSS) score of 9.2, which is scary bad. After all, about 70% of websites with an identifiable server-side language run on PHP-based systems like WordPress.But does that mean people are patching their servers as fast as they can?To quote Moshe Siman Tov Bustan of Ox security: “The panic hasn’t turned into patching.” Ox reports in a new blog post that of October 26, five days after disclosure, the picture has barely shifted – 93.6% still exposed.“”thenewstack.io/php2shell-unpat#CyberSecurity #PHP #PHP2Shell #Programming #SoftwareDevelopment