# Red by run.cloud > Website security scanning. The free scan reads the stack a site serves and matches each version to known vulnerabilities (one per domain, after the owner proves the domain with a DNS record). The full scan ($100) sends an AI red team that proves access once, stops, and reports the path and the fix. The guides at https://red.run.cloud/learn are dated, cite primary sources inline, and describe results in three states: detected, unknown, or confirmed by owner evidence. Each guide has a Markdown copy at https://red.run.cloud/md/learn/. ## Product - [Red home and free scan](https://red.run.cloud/): what the scans check, pricing, FAQ - [All guides](https://red.run.cloud/learn): every topic and article ## October 2026 incidents The tracker, the checklist, and why so much broke at once. Pillar page: https://red.run.cloud/learn/topics/hub - [October 2026 Security Checklist: What to Do This Week](https://red.run.cloud/learn/october-2026-security-checklist-this-week): October 2026 security checklist by role: website owners, agencies, server teams and AI tooling. Tick-off lists, fixed versions, and the exact question for your host. (updated 2026-10-23; Markdown: https://red.run.cloud/md/learn/october-2026-security-checklist-this-week) - [October 2026 Security Incidents: Every One, Tracked](https://red.run.cloud/learn/october-2026-security-meltdown-tracker): October 2026 cyber incidents in one table: PHP2Shell, GitLab, LiteLLM, Railway, Zeabur and more, with fixed version, required action, status and source. (updated 2026-10-23; Markdown: https://red.run.cloud/md/learn/october-2026-security-meltdown-tracker) ## PHP2Shell The PHP core RCE: versions, fixes, hosts, stacks, and how to confirm the running service is patched. Pillar page: https://red.run.cloud/learn/topics/php2shell - [Is PHP2Shell being exploited? Attempts vs compromise](https://red.run.cloud/learn/is-php2shell-being-exploited): Is PHP2Shell being exploited? AWS and watchTowr report honeypot attempts, Cloudflare reports attack traffic on its customers. No source names a hacked site. (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/is-php2shell-being-exploited) - [PHP2Shell checker: what a check can and can't confirm](https://red.run.cloud/learn/php2shell-checker-what-we-can-confirm): Is my site vulnerable to PHP2Shell? A checker sees a banner, not a patch. What it can confirm, why version numbers mislead, and how to get proof from your host. (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/php2shell-checker-what-we-can-confirm) - [PHP2Shell fixed versions: every PHP branch, one table](https://red.run.cloud/learn/php2shell-fixed-versions-table): PHP2Shell fixed version for PHP 8.5, 8.4, 8.3 and 8.2, plus what to do on 8.1 and older. The branch table with distro backports, checked 24 October 2026. (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/php2shell-fixed-versions-table) - [PHP2Shell fix: patch PHP, restart workers, verify it ran](https://red.run.cloud/learn/php2shell-fix-patch-php-runtime): PHP2Shell fix steps per channel: Debian, Ubuntu, RHEL, Alpine, cPanel, Docker, Heroku. Update the package, restart the workers, then verify the running service. (updated 2026-10-23; Markdown: https://red.run.cloud/md/learn/php2shell-fix-patch-php-runtime) - [PHP2Shell for Small Business: A 10-Minute Plain Plan](https://red.run.cloud/learn/php2shell-small-business-10-minute-response): PHP2Shell is a flaw in PHP, the software behind most websites. Ten minutes, one question for your host, and what the answer means. No jargon. (updated 2026-10-23; Markdown: https://red.run.cloud/md/learn/php2shell-small-business-10-minute-response) - [PHP2Shell: affected versions, fixes, and what to do now](https://red.run.cloud/learn/php2shell): PHP2Shell (CVE-2026-109618/109619) is an unauthenticated RCE in PHP core. Fixed versions, who is affected, and how to confirm the PHP serving your site is patched. (updated 2026-10-23; Markdown: https://red.run.cloud/md/learn/php2shell) ## Is my host patched? One page per hosting provider: their dated status, what to ask support, and how to confirm it yourself. Pillar page: https://red.run.cloud/learn/topics/hosts - [PHP2Shell on shared hosting: what to ask your host](https://red.run.cloud/learn/php2shell-shared-hosting-what-to-ask-your-provider): On shared hosting your provider patches PHP, not you. The exact question to send, an email template, what each reply means, and 12 hosts' dated status. (updated 2026-10-23; Markdown: https://red.run.cloud/md/learn/php2shell-shared-hosting-what-to-ask-your-provider) ## Other incidents GitLab, LiteLLM, Railway, TiDB Cloud, Zeabur, Node.js, Plex, Tor, eMudhra, SafePay. Pillar page: https://red.run.cloud/learn/topics/incidents - [GitLab CVE-2026-110264: CVSS 10.0 RCE and fixed versions](https://red.run.cloud/learn/gitlab-cve-2026-110264-critical-rce): GitLab CVE-2026-110264 is a CVSS 10.0 unauthenticated RCE in self-managed GitLab. Fixed versions for every release line, who is in scope, and how to upgrade. (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/gitlab-cve-2026-110264-critical-rce) - [Node.js security update: 10 CVEs, Brotli RCE, fixed versions](https://red.run.cloud/learn/nodejs-october-2026-security-patches): Node.js security update 2026: Brotli RCE CVE-2026-111497 plus nine more CVEs, fixed in 22.23.4, 24.22.1 and 26.12.1. Who is affected and how to upgrade. (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/nodejs-october-2026-security-patches) ## Landscape and analysis What the incidents mean for stores, agencies, startups and small businesses. Pillar page: https://red.run.cloud/learn/topics/landscape - [Who patches my website: your host, your agency or you?](https://red.run.cloud/learn/who-is-responsible-for-patching-my-website): Who patches my website depends on the layer and your plan. A responsibility matrix for shared, managed, VPS, agency and Shopify sites, with October 2026 as the example. (updated 2026-10-23; Markdown: https://red.run.cloud/md/learn/who-is-responsible-for-patching-my-website) ## Website security basics Hacked signs, checklists, scanning, hardening, who patches what. Pillar page: https://red.run.cloud/learn/topics/evergreen - [How to verify a vulnerability is fixed: 5 proofs to ask for](https://red.run.cloud/learn/how-to-verify-a-vulnerability-is-fixed): How to verify a patch worked: five pieces of evidence that show a vulnerability is fixed, what each proves, what it misses, and a PHP2Shell worked example. (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/how-to-verify-a-vulnerability-is-fixed) - [What an external website scan can't prove (and what can)](https://red.run.cloud/learn/what-an-external-website-scan-cant-prove): Can a website scan prove my site is secure? No. What an outside scan can see, the five things it cannot, and the owner evidence that settles each one. (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/what-an-external-website-scan-cant-prove) ## WordPress Plugin and theme incidents, hidden admins, cleanup, and the vendor-key problem. Pillar page: https://red.run.cloud/learn/topics/wordpress - [WordPress PHP2Shell fix: update PHP, not just WordPress](https://red.run.cloud/learn/does-php2shell-affect-wordpress): Does PHP2Shell affect WordPress? Yes, the bug is in PHP, so WordPress updates do not fix it. Get the fixed PHP builds and the exact question to ask your host. (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/does-php2shell-affect-wordpress) ## Hosting panels cPanel, Plesk, CyberPanel, Cloudflare origin exposure. Pillar page: https://red.run.cloud/learn/topics/hosting-panels - [PHP2Shell on cPanel: find and update PHP per domain](https://red.run.cloud/learn/php2shell-cpanel-update-php): PHP2Shell on cPanel: see which PHP each domain runs in MultiPHP Manager or Select PHP Version, update EasyApache, restart PHP-FPM and confirm the fix ran. (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/php2shell-cpanel-update-php) ## Secrets and supply chain .env exposure, rotation runbooks, npm worms, GitHub Actions. Pillar page: https://red.run.cloud/learn/topics/secrets-supply-chain - [Rotate secrets after a breach: order, steps and checks](https://red.run.cloud/learn/rotate-secrets-after-a-breach-guide): How to rotate secrets after a breach: what to revoke first, why editing a dashboard variable is not rotation, and how to prove it worked. Dated 24 October 2026. (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/rotate-secrets-after-a-breach-guide) ## Agencies and MSPs Many client sites, one incident, shared tools. Pillar page: https://red.run.cloud/learn/topics/msp-agency - [PHP2Shell for agencies: client triage and evidence list](https://red.run.cloud/learn/php2shell-agency-client-triage): PHP2Shell agency response: group client sites by who controls PHP, collect proof for each site, and tell each client what is confirmed and what is not (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/php2shell-agency-client-triage) ## Incident response The first 24 hours, clean restores, reinfection, telling customers. Pillar page: https://red.run.cloud/learn/topics/incident-response - [Was my site exploited via PHP2Shell? Indicators to check](https://red.run.cloud/learn/was-my-site-exploited-via-php2shell): Check whether PHP2Shell (CVE-2026-109618/109619) hit your site before you patched: the 17 October look-back window, indicators to check, and what to rotate. (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/was-my-site-exploited-via-php2shell) - [Website Incident Response Plan: What To Do When Hacked](https://red.run.cloud/learn/website-incident-response-playbook): A website incident response plan for owners: the first hour, what to preserve, who to tell and when, and how to recover without being hacked a second time. (updated 2026-10-24; Markdown: https://red.run.cloud/md/learn/website-incident-response-playbook) _20 guides. Generated from the site's content at build time._