PHP2Shell is a pair of critical PHP bugs, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. What they are, how they work, which versions fix them, and how to verify your patch actually landed.
The 2026 new gTLD list includes strings like .login, .verified, .official and .auth. None can host a lookalike domain yet. What the list shows, what .help already looks like, and what a brand owner can do now versus at launch.
Six headers cover most of the real risk, and the free scanner every checklist points you to recently lost its API. Here is what actually matters, what to skip, and how to verify it without depending on a one-off manual scan.