“php2shell”, two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619)
An attacker who isn’t logged in can take over the server through any website PHP serves, and early attacks have already been seen. websites are only affected if PHP is installed and Caddy passes requests to it, usually through php-fpm.
luckily i dont have php, so my website is save aww yeahhh, take that other 70%.