PHP2Shell: critical PHP RCEs, WAF rules inside

Preview text: PHP2Shell: critical PHP RCEs, WAF rules inside 96 ASTRO's rules and detections

Wednesday, Oct 21, 2026 at 11:40 AM EasternKlaviyo

Abstract SecurityPHP2Shell: critical PHP RCEs, WAF rules inside

Fit to screenFull size

Subject: PHP2Shell: critical PHP RCEs, WAF rules inside
Preview text: PHP2Shell: critical PHP RCEs, WAF rules inside 96 ASTRO's rules and detections
From: marketing@em.abstract.security
Brand: Abstract Security
ESP: Klaviyo
Sent: Wed Oct 21, 2026, 11:40 AM ET
Size: 46 KB
Images: 5
Links: 7, 1 of them buttons
Subject length: 46 characters

Against Abstract Security's usual

Sent in the 11 AM hour, which holds 4% of its emails; 20% arrive in the 12 PM hour. The subject is 46 characters; its average is 51.

Email headers

What the brand's servers put on this email. Our receiving servers, the address we subscribed with and unsubscribe links are left out.

From: Abstract <[email protected]>
Reply-To: [email protected]
Subject: PHP2Shell: critical PHP RCEs, WAF rules inside
Date: Wed, 21 Oct 2026 11:40:54 -0400
Message-ID domain: 246044907m.em.abstract.security
Return-Path domain: 246044907m.em.abstract.security
DKIM signature: d=246044907m.em.abstract.security s=hs2; d=em.abstract.security s=hs1-246044907
List-Unsubscribe: Present, one-click
Feedback-ID sender: HubSpot

Other sending headers (names only): X-HS-Cid, X-Report-Abuse-To

	Oct 29, 2026 12:54 PM	A breakup, two PHP RCEs, and a Halloween webinar
	Oct 27, 2026 5:17 PM	Are you afraid of the SOC? 🔦
	Oct 21, 2026 11:40 AM	PHP2Shell: critical PHP RCEs, WAF rules inside (this email)
	Oct 20, 2026 3:35 PM	AITA for wanting to leave my SIEM? 💔
	Oct 7, 2026 6:36 PM	Allow Me to Reintroduce Myself
	Oct 3, 2026 1:22 PM	New from ASTRO: NetScaler zero-days. Hunt before you patch
	Oct 1, 2026 8:09 PM	New from ASTRO: Your WAF has a side entrance 🫣