For injection attacks (SQLi, SSTI, SSRF, XXE, command injection, PHP type juggling, PHP file inclusion), see server-side.md. For deserialization attacks (Java, Pickle) and race conditions, see ...
In this blog, Arctic Wolf Labs analyzes PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and discusses active exploitation ...