Чем уязвимости PHP грозят домашним пользователям

Two critical, unauthenticated remote-code-execution flaws in PHP — CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell — were disclosed yesterday and already patched a day later, but the fallout reaches far beyond corporate servers since PHP powers roughly 70% of all websites. Home users face real risks too: attackers can steal session tokens to hijack accounts without passwords or 2FA, tamper with files on vulnerable network storage, or plant malware and phishing pages on otherwise legitimate sites. Confirmed affected products include the Jeedom smart-home platform (fixed in 4.6.2, requiring two update runs), NAS systems from QNAP, Synology and ASUSTOR, the Unraid OS (patched in 7.3.4 with PHP 8.4.27), and Nextcloud All-in-One (fixed in 14.4.1). Several online games — including Final Fantasy XIV, Pokemon Champions, Granblue Fantasy and titles from Bandai Namco — temporarily shut down servers for emergency maintenance, and two long-running Japanese games were permanently closed because their outdated infrastructure couldn't be patched; users are advised to update affected devices immediately, use strong unique passwords with 2FA, and keep offline backups of important files.