B · Hall of smart-shame Oh no, you didn’t?

PHP, any version since 5.4

And so was the exploit. Prices change.

Two flaws nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, both rated 9.2) let a stranger run code on a PHP web server without logging in. Every version back to 5.4 has at least one of them, the details leaked a day before the fixes, and attacks started within hours. If you run PHP, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today, then come back and finish reading this row.

Online

Wi-Fi, Ethernet or cellular. An attacker can be anywhere, and it can collect data.

Buy the dumb one instead

• Hardback guestbookLevel 0 · No electricity · Dumb as a rock $15–25View
• IBM Selectric typewriterLevel 1 · Electric, no logic · An electric rock $150–400View
• Static HTML on a USB stickLevel 2 · A quiet chip · Dependable doofus $8–12View

We do not link to the smart one. You can find it.