Welcome to the October 23 edition: a serious PHP security update, plus a pair of faster networking switches for offices that have outgrown Gigabit. One item needs attention this week; the other is an upgrade for teams already feeling a network bottleneck.
Security Brief: PHP2Shell deserves attention this week
Two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, can allow unauthenticated remote code execution on affected PHP servers. In plain English, an attacker may be able to run code on a vulnerable server without first signing in. That could expose sensitive information, server files and databases, making this a patch-priority issue, not a reason to panic, but definitely not one to leave on the “later” list.
Security fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, as applicable to the server’s supported release branch. Researchers and authorities have advised updating, and temporary mitigations have been described as insufficient substitutes for applying the fixes. The NSA urged organizations using PHP to prepare updates and warned that attackers could gain direct access to server file systems and databases; if an affected system cannot be patched immediately, its recommendation is to take it offline until it is fully patched. The FBI and cybersecurity authorities in Singapore, the UK, Australia, Canada and the EU have also issued warnings.
There is another reason to take the disclosure seriously: Amazon says its threat intelligence team detected attempts to exploit the flaws before public disclosure, using MadPot, its system for monitoring suspicious activity across internet-facing infrastructure. Amazon says it remains unclear how attackers learned about the vulnerabilities ahead of disclosure. Meanwhile, Google says its cybersecurity unit Wiz used AI models to help find and investigate the flaws, and Gemini helped assess them, test potential attacks and verify patches; OpenAI says researchers working with its models helped uncover critical PHP vulnerabilities and that it spent the past two months coordinating fixes with maintainers and security partners. Cloudflare says it deployed web application firewall protections to block malicious requests. Helpful layers, yes, but they don’t replace updating PHP.
For a small-business owner, the first step is to find out what is actually running. PHP powers many websites and web applications, and a public-facing site’s version is not always obvious from its dashboard. Ask the hosting provider or whoever manages the site which PHP version is active and confirm that it is on a fixed release. Check whether the CMS, plugins and themes are current, and keep an eye out for signs of tampering such as unexpected administrator accounts, modified files or unusual outbound traffic. If a site is managed by a host, ask for confirmation of the patch level rather than assuming it has been handled. This is a sensible item to put on the agenda this week.
Desk Upgrade: QNAP’s QSW 2000 lite-managed switches
Not every network needs to race toward 10GbE. But when a NAS, server or Wi-Fi 6E/7 access point can move data faster than a Gigabit switch allows, the switch can become the slow link in an otherwise capable setup. QNAP’s QSW 2000 series, announced in October and reported by Club386, aims for the middle ground: more control than an unmanaged switch, without the complexity of a full Layer 2 platform.
The QSW-L2110-10T is listed at $179 / £213 and combines eight 2.5GbE Base-T ports with two 10GbE Base-T RJ45 ports. The copper ports work over existing Cat 5e or Cat 6 cabling, which may make it easier to upgrade a suitable installation without replacing every cable. The QSW-L2110-2S8T is listed at $129 / £147; it has the same eight 2.5GbE LAN ports, but uses two 10GbE SFP+ fibre ports instead of copper. Those fibre uplinks suit longer-distance connections or switch cascading, and the model can pair with a fast NAS.
Both switches use QNAP’s QSS web interface and offer practical small-office controls: VLAN segmentation to separate traffic, QoS to prioritize selected traffic such as calls, and LACP link aggregation to combine supported links. IGMP snooping helps limit multicast traffic to devices requesting it, while loop prevention helps guard against broadcast storms caused by cabling loops. Both models are fanless for silent operation and come with a five-year warranty, according to Club386.
The short version: this could be a useful step up when Gigabit is already holding faster equipment back, and the lite-managed features match common small-office needs without requiring a deep dive into enterprise networking. But a handful of devices and ordinary internet service do not automatically justify 10GbE. This is for the office or power user that is actually hitting the ceiling, not a compulsory upgrade for every router closet.
One important distinction: the PHP2Shell security story and QNAP’s switch announcement are separate topics. Buying a faster switch does not patch a website’s PHP installation; confirm the web host’s software updates independently.
Daily Links
- CNBC: Critical PHP web security flaws spark global alarm as Google, OpenAI and Amazon respond
- Club386: QNAP’s QSW 2000 lite-managed 10GbE switches
Grow with Network Repair1
Network Repair1 is building a technology-focused audience with 13,000 YouTube subscribers and more than 1.1 million lifetime views. That reach gives brands and viewers a place to discover useful products, practical tutorials and engaging technology content.
Promote with Network Repair1
- 🎥 Shopify and Amazon sellers: We create product videos and reviews that can showcase products to an engaged audience.
- 💻 Remote IT support: We help individuals and small businesses troubleshoot computers, networks and Microsoft 365 remotely.
- 🤝 Let’s collaborate: We can build content and technical support around your goals, together.
Today’s links & contact
We've done the troubleshooting so you don't have to. Shop the gear we use and recommend for a high-performance setup.
The items mentioned are featured on the YouTube channel.
https://www.amazon.com/shop/networkrepair1?ref_=cm_sw_r_cp_ud_aipsfshop_XV0ER95A5EVVJDPA7W6A_1
805-723-9608
Leave a Reply