October 21, 2026
PHP2Shell: two critical flaws in the engine under most websites
The PHP project published fixes for two critical vulnerabilities that let an attacker run code on a server without any password. What happened, which versions are exposed, and why a version number alone cannot settle every case. Read the explainer
September 2026
The WordPress flaw CISA lists as actively exploited
A core flaw affects WordPress 4.7.0 to 7.1.1 and is being used against real sites. What "inside the exploited range" honestly means, and the update that closes it. Read the explainer
October 2026
Your domain can be impersonated by email, unless one record says otherwise
SPF, DKIM, and DMARC in plain words: the three records that decide whether a stranger can send invoices in your name, and why the enforcing step is the one most domains never take. Read the explainer