Posts by Shubham Kumar Khatang
PHP2Shell (CVE-2026-109618, CVE-2026-109619): Analysis and Observed Exploitation Attempts
Executive Summary On October 21, 2026, the PHP project released emergency fixes for CVE-2026-109618, “RCE via OOM corruption” (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619, “RCE via stale global state” (GHSA-6wmf-4rv5-p3rp). Both are rated 9.2 under CVSS v4.0, and neither requires authentication or user interaction. Researchers have named the pair PHP2Shell. What makes PHP2Shell different from most web bugs is where it lives. Because the flaws are in the engine rather than in any site’s code, any website running a vulnerable PHP version can be attacked, even a basic one-page site. Keeping WordPress, Drupal, or Laravel up to date doesn’t help if the PHP…
Zero Trust Network Isolation for Agentic AI: Lessons from Anthropic’s Sandbox Incidents
Anthropic’s alignment assessment describes four incidents in which Claude models left their test environments and gained unauthorized access to real third-party systems. This post explains why prompt instructions failed to contain them and how zero trust network isolation supports agentic AI security by closing egress paths.
Research Lab
PHP2Shell (CVE-2026-109618, CVE-2026-109619): Analysis and Observed Exploitation Attempts
By Shubham Kumar Khatang
October 30, 2026
Executive Summary On October 21, 2026, the PHP project released emergency fixes for CVE-2026-109618, “RCE via OOM corruption” (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619, “RCE via stale global state” (GHSA-6wmf-4rv5-p3rp). Both are rated 9.2 under CVSS v4.0, and neither requires authentication or user interaction. Researchers have named the pair PHP2Shell. What makes PHP2Shell different from most web bugs is where it lives. Because the flaws are in the engine rather than in any site’s code, any website running a vulnerable PHP version can be attacked, even a basic one-page site. Keeping WordPress, Drupal, or Laravel up to date doesn’t help if the PHP…
AI Thought Leadership
Zero Trust Network Isolation for Agentic AI: Lessons from Anthropic’s Sandbox Incidents
By Shubham Kumar Khatang
October 20, 2026
Anthropic’s alignment assessment describes four incidents in which Claude models left their test environments and gained unauthorized access to real third-party systems. This post explains why prompt instructions failed to contain them and how zero trust network isolation supports agentic AI security by closing egress paths.
Subscribe to the Versa Blog
Recent Posts
Deliver Fair, Differentiated QoS for GenAI Traffic with Versa
By Christopher WongNovember 5, 2026
Building Enterprise-Ready Remote Sites with Versa and Starlink
By Christopher WongNovember 3, 2026
AI Sovereignty Starts with Sovereign SASE
By Matthew BrooksOctober 27, 2026
Topics
Top Tags
Gartner Research Report
2026 Gartner® Magic Quadrant™ for SASE Platforms
Versa has for the fourth consecutive year been recognized in the 2026 Gartner Magic Quadrant for SASE Platforms1 and is one of only 12 vendors that met the criteria for inclusion based on the analysts’ evaluation of the VersaONE Universal SASE Platform.