Yesterday, October 21, 2026, two critical security vulnerabilities in PHP were publicly disclosed (CVE-2026-109618 and CVE-2026-109619, also known as "PHP2Shell"). They could allow an attacker to run malicious code on a web server without logging in. This programming language runs on 70% of the known web, likely a similar percentage of the dark web, and most private corporate networks used internally, not available off network.

You may have seen this in the headlines. If not, click here:

https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl

I spent the greater part of the day learning to write terminal commands to check the 300+ accounts on our server for unauthorized access and malicious behavior. While the likelihood of an attack on us was small, I’m overly cautious because I’ve been a webmaster since 1995 and I’ve been hacked twice by Russian and Chinese miscreants.

At any rate, after updating and applying the patches, I went through the logs to make sure we were ok. I just received confirmation from our server company on my watch while driving home after tonight’s COLA event that our updates were successful.

So, we’re good. Secure at least today. AI crisis averted.

I’m writing this to apologize for not having set up websites yet. I didn’t want to compound the problem. Understandably, many major companies took down their sites until this vulnerability could be resolved. So this wasn’t my paranoia. If unaddressed, this could’ve killed the Internet as we know it.

I spend a lot of time in campus courses talking about how fragile the internet actually is. It’s a literal miracle it works at all, with at least four programming languages and thousands of lines of code that must work together, just to render a single page. Be really glad you use a builder like Divi.

Anyway, I’m exhausted. I’ll set up everyone tomorrow. Please forgive any typos. I dictated this while driving home.

-30-