TL;DR: PHP2Shell ( CVE-2026-109618 , CVE-2026-109619 ) is a pair of critical remote code execution flaws in the PHP core (CVSS 9.2). In lab testing, the issue is not a narrow “one-off bug” — under the right conditions it can be driven from a simple code-execution check all the way to a reverse shell. Patch now. There is no complete mitigation other than updating. ⚠ Security notice: This post is for defensive awareness only. All demos were run in an isolated lab against a local containerized target. Do not probe systems you do not own. Watch the lab demo I recorded a short proof-of-concept walkthrough (English captions, lab-only): ▶ PHP2Shell RCE PoC — From Fatal Error to Reverse Shell https://www.youtube.com/watch?v=1D9i6-tUxaI Demo intro: patch immediately · isolated lab only What is PHP2Shell? On 21 October 2026 , the PHP project published a security advisory for two critical RCE vulnerabilities nicknamed PHP2Shell...
NeuroSDR user manual (3) — Sub VFO, satellite, digital voice, Smart Record, web remote Advanced workflows. The Sub VFO / multi-FT8 story assumes hardware with enough instantaneous bandwidth. Author: KD8CEC . 1. Sub VFOs on wide hardware (founding goal) A Sub VFO is an independent virtual receiver inside the RF capture window. On an RSP (or other wide source), you can: Listen to shortwave or CW on MAIN Run FT8 plugins on SUB1 / SUB2 / SUB3 at 14.074, 7.074, 7.040 MHz, … See decoded callsigns on the main waterfall when MAIN WF overlay is enabled If a Sub VFO leaves the capture, the UI shows OUT OF RANGE — raise sample rate / recenter, or accept that the decoder pauses. YouTube: RSP1 bandwidth + Sub VFOs + multi FT8 — full episode YouTube: Create Sub VFOs — 02:42 YouTube: Background FT8 while listening — 03:34 YouTube: OUT OF RANGE — 04:54 YouTube: 7.040 JA FT8 on Sub VFO — 11:38 Virtual Kiwi/WebSDR audio bandwidth is much narrower than a multi-MS/s RSP...