Week 44, 2026
Two "2Shell" bugs made this a patch-everything week. PHP2Shell, a pair of critical remote code execution flaws in PHP (CVE-2026-109618 and…
$ ls ~/weekly
Every link Webdevs has collected, one page per week, with notes on what mattered. The live feed moves on; the archive keeps everything.
Two "2Shell" bugs made this a patch-everything week. PHP2Shell, a pair of critical remote code execution flaws in PHP (CVE-2026-109618 and…
A heavy security week. Two critical PHP flaws, later named PHP2Shell, were disclosed on 21 October; Cloudflare had WAF rules in place before the…
Microsoft shipped fixes for more than 1,400 security vulnerabilities in a single batch, so this was a week for patching Windows fleets. The U.K. also…
The ShinyHunters story kept moving. A teenager from Amman, Jordan, suspected of leading the data theft and extortion group, has been detained and is…
Agents were the theme on the AI side, and the most useful posts were about where they go wrong. Hugging Face published work on source-aware verification…
Only one story made the cut this week. Krebs on Security reports that a U.S. Army soldier who pleaded guilty to hacking telecommunications companies and…
A quiet week with three good reads. Smashing Magazine argues that CSS container queries are still underused and often misunderstood, because people treat…