Critical "PHP2Shell" Vulnerabilities: Nearly 70% of the Web is Affected

 

Urgent Security Alert: Protect Your Servers from Critical "PHP2Shell" Vulnerabilities!

If your organization uses PHP in any capacity, it is time to drop everything and patch.

Cybersecurity agencies globally (including the UK's National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA)) are sounding the alarm over two critical vulnerabilities discovered in the core of PHP, one of the world's most popular server-side scripting languages.

These vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, carry a severe CVSS 4.0 score of 9.2 out of 10. Threat intelligence firms are already seeing proof-of-concept exploits and malicious activity in the wild.

Here is everything you need to know about this new "PHP2Shell" threat and, most importantly, the exact steps you need to take right now to protect your infrastructure.

How-To Live-Swap a Back-UPS Battery Safely

How to Live-Swap a UPS Battery; Safely

When an uninterruptible power supply (UPS) battery fails, it often triggers a loud, continuous alarm or displays a flashing battery error icon. In an enterprise environment, shutting down the server rack, NAS, or network switch connected to that UPS just to swap a battery means unwanted downtime.

Fortunately, UPS devices such as the APC Back-UPS Pro 1350 (BX1350M) support hot-swapping. This means you can replace the internal battery cartridge without powering down the unit or interrupting the critical equipment plugged into it.

Whether you are an end-user maintaining your workstation or a deployment technician following company infrastructure protocols, use this step-by-step guide to perform a hot-swap safely.

Online Speed Tests: Who's Good & Who Should You Use?

The Best Online Internet Speed Tests:
Which One Should You Actually Use?

We’ve all been there: your video call freezes, your game starts lagging, or that movie you’re trying to stream keeps buffering. Your first instinct is probably to Google "speed test," but did you know that not all speed tests are created equal?

While Ookla Speedtest (speedtest.net) remains the reigning champion for overall testing due to its massive global server network and historical tracking, relying on just one tool doesn't always tell the whole story.

Depending on what you are trying to do; whether that's hosting a Zoom webinar or trying to figure out if your ISP is throttling your Netflix. You need the right tool for the job!

Here is the ultimate breakdown of the best internet speed tests available today and when you should use them.

Set Up DMARC for Microsoft 365 Hosted Email

 

How to Set Up DMARC for Microsoft 365:
Stop Email Spoofing for Good!

If you own a custom domain, email security isn't optional anymore. Major email providers like Google, Yahoo, and Microsoft strictly require authentication records to ensure your emails reach the inbox instead of the spam folder.

Setting up DMARC (Domain-based Message Authentication, Reporting, and Conformance) prevents scammers from impersonating your business while boosting your overall email deliverability.

Here is a step-by-step guide to properly setting up DMARC alongside SPF and DKIM for Microsoft 365 (formerly Office 365).

Set Up DMARC for Google Workspace Email

How to Set Up DMARC for Google Workspace:
Stop Email Spoofing for Good!

If you own a custom domain, email security isn't optional anymore. Major email providers like Google, Yahoo, and Microsoft strictly require authentication records to ensure your emails reach the inbox instead of the spam folder.

Setting up DMARC (Domain-based Message Authentication, Reporting, and Conformance) prevents scammers from impersonating your business while boosting your overall email deliverability.

Here is a step-by-step guide to properly setting up DMARC alongside SPF and DKIM.

EINSTEIN: Protecting U.S. Federal Networks

 

EINSTEIN:
The Technology Protecting
U.S. Federal Networks

When you hear the name "Einstein," you likely picture the theoretical physicist with wild hair and equations on a chalkboard. But in U.S. government cybersecurity, EINSTEIN refers to a multibillion-dollar, automated intrusion detection and prevention system designed to protect digital traffic across federal civilian networks.

Below is a verified, source-backed breakdown of the EINSTEIN system, incorporating official documentation from the Cybersecurity and Infrastructure Security Agency (CISA), Government Accountability Office (GAO) audits, and presidential cybersecurity directives.

What Nobody Tells You Before You Upgrade a Computer

What Nobody Tells You Before an Upgrade

"I just bought a new computer and now my printer doesn't work. It works fine on the old one! The only drivers I can find are being blocked by Windows Security. And I can't install or activate my Office 2016 or my Quicken 2000!?"

It's a completely reasonable thing to expect. The printer works. The software works. You've used the same setup for eight years without a problem. So why wouldn't it work on a newer, faster, better machine?

The honest answer is that "newer" doesn't just mean "the same thing, but faster." When you skip several years between upgrades, you aren't taking one step forward. You're jumping across a gap where the rules changed several times while your old device quietly kept doing things the old way.

This article's aim is to try to cover why that happens, what usually breaks, and how to plan an upgrade so you aren't caught off guard.

Navigating the Cloud: A Washington Law Firm’s Guide

Navigating the Cloud: A Washington State Law Firm’s Guide to WSBA Advisory Opinion 2215

The legal industry is rapidly transitioning to cloud-hosted services for document storage, practice management, and client communication. The benefits are clear: reduced IT costs, enhanced collaboration, and the ability to work from anywhere. But for Washington lawyers, this digital shift brings up a critical ethical question: Is it safe, and is it compliant?

App Passwords: Why You Need Them & How to Set Them Up

 

Your Guide to App Passwords:

Why You Need Them & How to Set Them Up

Have you ever tried to connect an older email app, a smart home device, or a scanner to your main account, only to be hit with a stubborn "authentication failed" error; even though you know you typed your password correctly?

The culprit is likely your account's modern security settings. As Two-Factor Authentication (2FA) becomes the standard for protecting our online lives, many third-party apps and older devices simply don't know how to handle that second step. According to the Cybersecurity and Infrastructure Security Agency (CISA), using Multi-Factor Authentication (MFA) makes users 99% less likely to be hacked. However, it can break compatibility with older software.

Enter the App Password: a specialized, secure bridge that lets these devices connect without compromising your main account's security.

Remove or Change a Microsoft Office 365 Business Subscription

Remove/Change Microsoft Office 365 Business Subscriptions

Microsoft has made it surprisingly difficult to find the option to remove Microsoft 365 Copilot from a business subscription. If you're logged into the Microsoft 365 Admin Center and only see a combined subscription such as "Microsoft 365 Business Standard and Microsoft 365 Copilot", you may assume the Copilot license can't be removed separately.

How they have things setup to switch or cancel your subscription for a user, employee, etc. can be super confusing! So I wanted to make this guide to help folks out with the process.