PHP2Shell – A Pair of Critical PHP Vulnerabilities

A few days ago, a major announcement was made. PHP, the software that powers many websites on the Internet, had two major vulnerabilities. Many IT people (including myself) had to get busy and update our PHP instances.

The PHP vulnerabilities are designated as: CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 Critical).

The vulnerabilities allow attackers to exploit flaws in PHP’s memory handling by sending specially crafted web requests that cause out-of-memory conditions or fatal errors on the victim’s server. This can leave internal data uninitialized, or cause PHP workers to retain pointers to memory that has already been freed.

When PHP later accesses this invalid memory, attackers may manipulate its contents to redirect program execution, potentially achieving unauthenticated RCE with the privileges of the affected web-server process.

PHP has released fixes in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Updating is highly recommended.

These vulnerabilities are excellent examples of an open source project not being inherently secure, just because it is open source. For the record, I do not assume closed-source is inherently secure either.

Visit the links below to get more information:

 


Posted in Cloud, Computers, General, Internet and Servers, Operating Systems, Programming, Security, Software

Reports Claim Hackers Stole Thousands of GitHub Private Repositories

Some of my readers, especially longtime ones, may remember that I have warned multiple times about being careful which extensions you choose to install in your web browser. Installing the wrong one, especially one that contains malicious code, can compromise your computer’s security.

This time, it is a lesson on being careful which extension you install in Visual Studio Code (a.k.a. VS Code). In a nutshell, an employee at GitHub installed (or at least updated) an extension that had been contaminated with malware code. The extension then proceeded to steal the employee’s credentials and gain access to tons of GitHub’s own private repositories.

The report claimed the malware stole:

  • AWS keys
  • Database passwords
  • Kubernetes tokens
  • SSH credentials

I would venture a guess that other IP (intellectual property) was stolen too.

I will let you read the full report from X below.

 


Posted in Cloud, Computers, General, Internet and Servers, Operating Systems, Security, Software

Are Web Browser Extensions Safe to Use? (2025 Update)

Several years ago, I wrote about the potential risks associated with web browser extensions (also referred to as “add-ons”) being able to abuse their power and access sensitive user data.

I said if someone has installed a malicious browser extension, their web browsing data (e.g., browsing history, password credentials, what they type into a website, etc.) may get sent directly to the extension’s creator, putting the user’s online security and privacy at risk.

Today, I received an email with a link to a news article, explaining how 18 separate web extensions for Edge and Google Chrome were caught spying on people.

Here is the link to the article: https://www.malwarebytes.com/blog/news/2025/07/millions-of-people-spied-on-by-malicious-browser-extensions-in-chrome-and-edge

[Click here to view article as a PDF.]

This just goes to show, always be mindful about which web browser extensions you choose to install.

 

 

Update 08-22-2025

Here’s another example of why you should be careful with web browser extensions.

Chrome VPN Extension With 100k Installs Screenshots All Sites Users Visit


Posted in Android, Computers, General, Internet and Servers, Mobile Phone, Security, Software

Logical Fallacies – Genetic Fallacy

This logical fallacy is known as the “genetic fallacy”. This fallacy occurs when someone dismisses or accepts an argument / claim based solely on its origin, rather than if the information itself is true or not.

One popular genetic fallacy I have encountered on the Internet is when people say “we cannot accept information from blogs” or “just because it’s on a blog, it is not factual information”.

For example, one subreddit I visited a few weeks ago, stated they do not accept personal blogs. Of course, their context was that blogs are not a “legitimate” source of information, while implying that “official” sources of information are accurate.

A couple of problems with this:  1) It is incorrect to say that all personal blogs are not legitimate sources of information, and 2) “official” news sources are not necessarily the best place to get accurate information too, and are not above having click-bait titles for their articles.

In other words, some blogs will have good info, others will not. Same goes for “official” news sources.

Summary: Genetic fallacies are nothing more than someone’s accepting / rejecting information solely based on the source or origin of said information, instead of checking if the information is accurate.


Posted in General, Logical Fallacies, Society

‹ Older Posts