Blog
CVE-2026-115560: PHP's New Unpatched RCE, and the Exposure Window Just Got Longer
Two days after the PHP2Shell emergency patches, PHP disclosed CVE-2026-115560, a remote code execution flaw with no patch yet. It is narrower, but it proves a point: the next PHP flaw will not wait for your patch cycle.
PHP2Shell: Patch Now, Then Close the Exposure Window
Two critical PHP flaws allow unauthenticated remote code execution on most PHP servers. Here is what to patch, what to do if you can't patch today, and where a preemptive WAF fits.
React2Shell and the Emergency Patching Problem
The December 2025 React2Shell zero-day exposed a painful truth: most organizations still rely on emergency patching as their primary defense. Here is why behavioral WAFs handled it without breaking a sweat.
Critical WordPress RCE Vulnerability: wp2shell (CVE-2026-63030, CVE-2026-60137)
A critical pre-authentication remote code execution vulnerability in WordPress Core allows anonymous attackers to fully compromise any stock WordPress installation. Over 500 million websites are potentially affected.