Notes from the people who build p4ndora.
How we think about code security, where our ideas come from and what we learn while building.
php2shell is critical, so update PHP today.
Two critical flaws in PHP let an attacker run code on your server without logging in. Here is who is at risk, how to tell if you are affected, and the one fix that actually closes it.
Security advisory. Published October 21, 2026. 6 min read.
Before p4ndora reads your code, it translates it.
Every audit starts the same way. Your repository is turned into our own intermediate representation, a form of the program built for one job, finding the way in. This is where the idea comes from and what it changes.
Research. Published October 13, 2026. 6 min read.