Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Latest research

Our Research

Welcome to our research page, where we provide you with the latest news, trends, and insights in the fast-paced world of tech. Join us on this exciting journey and discover the transformative power of technology today.

PHP2Shell: a critical PHP flaw that reaches 70% of the web

Home ResearchPHP2Shell: a critical PHP...

PHP2Shell: a critical PHP flaw that reaches 70% of the web

9 minutes readOctober 22 2026

Trung Nguyen

Hacker. Builder. Educator. On a mission to make the internet safer.

0 Views

Đọc bản tiếng Việt tại đây / Read the Vietnamese version

TL;DR

On October 21, 2026, the PHP security team shipped an emergency fix for two critical vulnerabilities in the core of the language, which the researchers jointly named php2shell. Both allow remote code execution (RCE) without authentication. With a default mod_php setup, a single malicious request is enough to take over the server, before any application code has had a chance to run. In other words, an application-layer firewall, a login page or a website’s maintenance mode will not stop it.

What makes this worrying is that PHP sits behind most of the web applications in the world, so the exposed surface is very wide.

If you run web applications on PHP, do the following now:

Update PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (or the matching fix from your distribution), then restart every worker (php-fpm, httpd/mod_php). Old workers keep running the vulnerable code until they are restarted.
If you cannot patch right away, apply the temporary measures below and treat them as a stopgap, not a fix.
Review logs and look for signs of exploitation going back to at least October 17, 2026, because attack attempts were recorded before the public disclosure.

Why is a bug in PHP so serious?

PHP is the most widely used server-side language on the web. According to W3Techs, about 69% of websites whose server-side language is known run PHP, and it powers WordPress, Magento, Laravel and countless internal systems. A flaw in the application layer affects one piece of software. php2shell lives in the core of the language itself, in the code that handles requests, which every PHP application goes through. So it does not care which CMS or framework you run.

PHP runs about 69% of public websites worldwide

To understand both bugs, you need one detail about how PHP works. For each HTTP request, PHP sets up an environment, parses the input (query string, body, file uploads), runs your script, then cleans up so it is ready for the next request. The trouble sits at the seam of that lifecycle: something goes wrong while the request is being set up, or the cleanup is incomplete when the next request arrives.

Diagram of a browser reaching an HTTP server over the Internet, which passes the request to a CGI script layer — Figure 2: A simplified model of a web server handing a request to server-side code (a CGI diagram). PHP-FPM and Apache mod_php both perform this step in their own way.

Both CVEs come from one shared idea. When PHP hits a fatal error midway, especially running out of memory (OOM), it uses a shortcut jump (longjmp, which PHP calls a “bailout”) to leave the current context. That jump skips the code that would normally return internal data to a valid state. The result is half-built pieces of memory, or pointers that still reference freed memory, while the rest of PHP keeps treating them as valid. The two CVEs are two views of the same idea, which is why PHP fixed both in a single commit with a plain name: “Avoid state corruption via bailout”.

The name php2shell was coined by the research teams that found the bugs (Calif and Wiz). PHP itself does not use it.

CVE-2026-109618: memory corruption when RAM runs out

PHP titles this one “RCE via OOM corruption” in its report. When PHP parses a request, it allocates memory for many things: the array of parameters, the structure that stores headers, the buffer for upload data. If an allocation fails because the memory ceiling is reached, PHP bails out immediately. The problem is that in a few contexts, the request’s memory has already been “exposed” (treated as existing) but not fully initialized. After the bailout, request cleanup reads or branches on that half-built data. From an uninitialized variable mistaken for a valid object, an attacker can steer execution until it reaches a function pointer they control, and that is the door to code execution.

What makes this bug nasty is that forcing PHP to run out of memory at the right moment does not require a huge request. PHP’s report lists several ways to abuse multipart parsing (the request type used for file uploads) to push PHP to the edge of memory exhaustion while still passing default limits such as post_max_size. Beyond multipart, the Datadog team also reproduced the bug with an ordinary urlencoded request. So there is no single exploitation “recipe”. There are several entry points that lead to the same broken spot.

The report confirms the most severe case as unauthenticated RCE on mod_php with default memory and data limits. For PHP-FPM, source analysis shows the risk is still there, but no complete exploit has been demonstrated on that path, because FPM usually ends the child process when a request fails at the setup stage.

CVE-2026-109619: reusing old state that was already freed

PHP calls the second bug “RCE via stale global state”. PHP reuses worker processes for many requests in a row for performance. Between requests, it must reset global variables to a clean state. But if a fatal error (out of memory, execution timeout) interrupts the cleanup, some global pointers still reference memory that belonged to the finished request, memory that has already been handed back to the system. When the next request runs on the same worker, PHP uses that old pointer before the normal initialization has reset it. This is the classic use-after-free: a long-lived object holds a pointer into dead memory.

Diagram of a dangling pointer still referencing a deleted object while other pointers reference valid objects — Figure 3: A general illustration of the use-after-free idea: a dangling pointer still references a deleted object. In php2shell, that role is played by the state left behind after an out-of-memory error.

To exploit it, an attacker needs two requests on the same worker: one request “plants the seed” that leaves a dangling state, and a later one “harvests” it by making PHP reuse the freed memory. PHP’s report names three groups of places that consume stale state, and notably, all of them are in features that are on by default:

INI configuration diagnostics that run before request initialization. For example, warnings about deprecated options, raised through mod_php’s .htaccess or FPM’s environment variables. Turning off error display (display_errors, error_reporting, the @ operator) does not help here.
Backtraces on fatal errors in PHP 8.5 (the fatal_error_backtraces option, new in 8.5.0 and on by default). This is the strongest case demonstrated, and the basis of the confirmed RCE exploit on mod_php.
Session upload progress tracking (session.upload_progress). It is on by default and does not need the application to call session_start(), which means your website is affected even if it never uses the feature.

Why this is hard to stop

We usually assume an attack has to go through some page or feature of the application, so defenses such as requiring login, turning on maintenance mode, or installing a firewall plugin for WordPress would block it.

With php2shell on mod_php, they do not. Input parsing and the upload-progress handler run while PHP is still initializing the request, before the application module is loaded and before a single line of your code runs. On mod_php, cleanup even runs when initialization has failed. So an application that only prints “Hello World” can still be exploited, as long as it runs on a vulnerable PHP build with a default mod_php setup.

PHP-FPM is also affected, but it is harder. The confirmed exploit on FPM has to go through an application action after a successful initialization (for example, a piece of code that touches the session).

LAMP stack diagram with Linux, web server, PHP scripting and database connected to the Internet by requests and responses — Figure 4: Where PHP sits in a typical web stack (LAMP), a general illustration that proves nothing about the two CVEs.

How severe are the two vulnerabilities?

You will see php2shell scored differently depending on the source:

The PHP team (acting as CNA) scores both at CVSS v4.0 9.2 (Critical), noting high attack complexity.
NVD scores CVSS v3.1 9.8 (Critical).
Some distributors, such as Red Hat, SUSE and Amazon Linux, score 8.1 on CVSS v3.1 and rate it Important, because reliable exploitation needs heap manipulation and precise timing.
Ubuntu labels it Critical.

The difference lies in how exploitation difficulty is judged, not in the nature of the bug. Whether you read 8.1 or 9.8, this is still unauthenticated RCE in the PHP core, so for prioritization you should treat it as the highest tier.

Timeline

2024: A PHP core developer noticed the first sign of the OOM bug while handling a report from an audit run by Quarkslab and OSTIF. No concrete exploitation vector was found at the time, and the fix was delayed for months.
August 11, 2026: The Calif team reported RCE with this same root cause. OpenAI independently reported the same cause on the same day.
August 24, 2026: Wiz reported additional attack vectors.
October 17, 2026: AWS’s MadPot honeypot system recorded an attempt to exploit php2shell, four days before disclosure.
October 20, 2026: The CVE IDs leaked publicly (with a wrong score of 10.0 and a wrong release time). The PHP team issued an early notice and moved the release up by one day.
October 21, 2026: PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 released, around 14:00 UTC (about 21:00 in Vietnam).

Real-world exploitation

At release time, the PHP team said it had not seen any complete working exploit, and CISA had not recorded exploitation either. Within hours, however, several vendors reported attack attempts: AWS (since October 17, through honeypots), Cloudflare (attack traffic with constantly changing payloads), and watchTowr (observed on a honeypot). AWS even described php2shell as “being widely exploited”, although it also said it is unclear whether those attempts succeeded on real systems.

As of October 22, 2026, no real-world intrusion has been publicly confirmed, and neither CVE is in CISA’s KEV catalog. But the gap between “attempted” and “successful” attacks is closing fast, and many PoCs have appeared on GitHub, including fake PoCs that carry malware.

Recommendations for organizations

1. Patch now, and restart your workers

The only complete fix is to update PHP to one of the patched versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35, or the matching fix from your distribution. After updating, you must restart every process that runs PHP (php-fpm, httpd with mod_php, long-running background workers). Old workers stay in memory and keep running the vulnerable code until they are restarted.

A note on checking: many distributions (Ubuntu, Debian, RHEL, AlmaLinux, SUSE…) fix by backporting, which keeps the old upstream version number. So do not conclude anything from php -v alone. Check the package version with your operating system’s package manager (for example rpm -q php-common, dpkg -l php8.2) and compare it with the fixed version your distribution publishes.

2. If you cannot patch yet: temporary measures

PHP states clearly that the measures below only reduce the attack surface on some paths and do not make a system completely safe:

For CVE-2026-109618 (OOM): set memory_limit = -1 at the admin level (php_admin_value) so applications cannot override it, combined with request size limits at the proxy or web server in front, and the cgroup memory limit so that only a single worker is taken down when needed. Warning: do not use RLIMIT_AS / RLIMIT_DATA to enforce limits, because they make memory allocation fail and trigger the very same bug path. With memory_limit = -1, a single request can eat all the server’s RAM, so monitor memory closely and restore the limit right after patching.
For CVE-2026-109619 (stale state): set session.upload_progress.enabled = 0, and on PHP 8.5 also fatal_error_backtraces = 0. Set them in php.ini, a drop-in file in conf.d, or the FPM pool (php_admin_flag), not through ini_set() or .user.ini, which take effect too late. Restart every worker after changing them. This only blocks the confirmed paths, not every variant.
Block multipart at the edge: if the application does not use multipart/form-data uploads, block that request type at the web server before it reaches PHP. Note that this breaks file upload features (for example product image uploads on Magento) and some payment forms.
Last resort: if you cannot do anything in time, consider taking public-facing PHP systems offline, or allowing only GET/HEAD methods until you patch. CISA, the UK NCSC and CERT-EU all recommend this for the worst case, especially for mod_php and PHP 8.1 and earlier.

On WAFs: a WAF is one layer and does not replace patching. A rule that blocks by size can reduce the OOM path (109618) but cannot block the very small upload-progress requests of 109619. If you already use a WAF from Cloudflare, AWS, Akamai and others, turn on the php2shell rule sets they have published, but still patch.

3. Hunt for signs of exploitation

A successful exploit may leave few traces (an HTTP 200 response, no worker crash, no application log), so seeing no errors does not mean you are safe. Some signs worth checking:

In PHP logs: the error line PHP Fatal error: Allowed memory size of N bytes exhausted ... in Unknown on line 0. The phrase “Unknown on line 0” shows the error happened during request initialization, before any script ran. Cross-check it against unusual POST requests, worker crashes, or Apache reporting “AH00052 … Segmentation fault”.
Post-exploitation signs (the most important): a PHP or web process (php-fpm, php-cgi, httpd, apache2) spawning a shell (sh, bash), especially with an outbound connection, or calling curl, wget or nc. Reconnaissance commands such as whoami, id and uname running as the web server user often follow. CISA also confirms that “a PHP process launching a shell or downloading tools” is a signal to watch.
Because leaked worker memory may contain passwords, tokens and API keys, rotate these secrets after patching if you suspect exposure.
Review window: start from at least October 17, 2026, because attack attempts were recorded before the public disclosure.

4. Inventory every place PHP runs

PHP can sit in containers, in prepackaged software, in PHP managed by a control panel (cPanel, Plesk, DirectAdmin…), or in a self-compiled build. List every PHP runtime that serves HTTP and patch each one. End-of-life versions (5.x, 7.x, 8.1 and earlier) are especially risky because they have almost no official fix.

Contact CyStack for support

For organizations that use CyStack services, our team can help review your exposed PHP attack surface, check configurations, and hunt for signs of exploitation in your systems. If you are not sure whether your infrastructure runs a vulnerable PHP version, contact us for a check.

References

PHP advisory: php.net/archive/2026
GHSA-w8hw-w9fx-j79w (CVE-2026-109618): github.com/php/php-src
GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): github.com/php/php-src
PHP Foundation post on the incident and release process: thephp.foundation
NVD CVE-2026-109618: nvd.nist.gov
NVD CVE-2026-109619: nvd.nist.gov
Calif analysis: calif.io/php2shell
Wiz analysis: wiz.io
Datadog Security Labs analysis: securitylabs.datadoghq.com
CISA alert: cisa.gov
CERT-EU advisory: cert.europa.eu

About the author

Trung NguyenHacker. Builder. Educator. On a mission to make the internet safer.

Hacker. Builder. Educator. On a mission to make the internet safer.

Stay up to dateGet the latest threat intelligence, cybersecurity reports from CyStack delivered to your inbox

Comments (0)

"<!DOCTYPE html>\n<html>\n <head>\n <title>Sign in ・ Cloudflare Access</title>\n \n <meta charset=\"utf-8\" />\n <meta name=\"robots\" content=\"noindex\" />\n <meta name=\"viewport\" content=\"initial-scale=1, maximum-scale=1, user-scalable=no, width=device-width\" />\n <link rel=\"icon\" type=\"image/svg+xml\" href=\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 62 50'%3E %3Cstyle%3E path %7B fill: url(%23gradient-light); %7D @media (prefers-color-scheme: dark) %7B path %7B fill: url(%23gradient-dark); %7D %7D %3C/style%3E %3Cdefs%3E %3ClinearGradient id='gradient-light' x1='30.7' y1='0' x2='30.7' y2='49.8' gradientUnits='userSpaceOnUse'%3E %3Cstop stop-color='%23332CB3'/%3E %3Cstop offset='1' stop-color='%23456FDD'/%3E %3C/linearGradient%3E %3ClinearGradient id='gradient-dark' x1='30.7' y1='0' x2='30.7' y2='49.8' gradientUnits='userSpaceOnUse'%3E %3Cstop stop-color='%23FFFFFF'/%3E %3Cstop offset='1' stop-color='%23E0E0E0'/%3E %3C/linearGradient%3E %3C/defs%3E %3Cpath d='M21.3 15.6h-7.8C17.2 6.4 26.1 0 36.6 0c13.7 0 24.9 11.1 24.9 24.9 0 13.7-11.1 24.9-24.9 24.9-10.4 0-19.4-6.4-23.1-15.6h7.8c3.1 5.1 8.8 8.6 15.3 8.6 9.9 0 17.9-8 17.9-17.9 0-9.9-8-17.9-17.9-17.9-6.5 0-12.1 3.4-15.3 8.6zm-12 14l-3.1-3.1h36.7c1.4 0 2.1 1.7 1.1 2.7l-6.2 6.2-2.2-2.2 3.6-3.6H9.3zm23-12.9l2.2-2.2 6.2 6.2c1 1 .3 2.7-1.1 2.7H3.1L0 20.2h35.9l-3.6-3.5z'/%3E %3C/svg%3E \" />\n <article id=\"data\"\n data-auto-redirect-to-identity=\"false\"\n data-auto-redirect-url=\"\"\n data-message=\"\">\n </article>\n <style>@charset \"UTF-8\";@-webkit-keyframes bang{0%,5%{-webkit-transform:translate3d(0,0,0);transform:translate3d(0,0,0);opacity:1}80%{opacity:1}to{opacity:0}}@keyframes bang{0%,5%{-webkit-transform:translate3d(0,0,0);transform:translate3d(0,0,0);opacity:1}80%{opacity:1}to{opacity:0}}@-webkit-keyframes rotate{0%,to{-webkit-transform:rotate(0deg) translate(0,0);transform:rotate(0deg) translate(0,0)}60%{-webkit-transform:rotate(-10deg) translate(16px,8px);transform:rotate(-10deg) translate(16px,8px)}}@keyframes rotate{0%,to{-webkit-transform:rotate(0deg) translate(0,0);transform:rotate(0deg) translate(0,0)}60%{-webkit-transform:rotate(-10deg) translate(16px,8px);transform:rotate(-10deg) translate(16px,8px)}}:root{color-scheme:light;--color-kumo-canvas:oklch(98.75% 0 0);--color-kumo-elevated:oklch(98% 0 0);--color-kumo-recessed:oklch(96% 0 0);--color-kumo-base:#fff;--color-kumo-tint:oklch(97% 0 0);--color-kumo-control:#fff;--color-kumo-line:oklch(14.5% 0 0 / 0.1);--color-kumo-hairline:oklch(93.5% 0 0);--color-kumo-fill:oklch(92.2% 0 0);--color-kumo-brand:oklch(57.72% 0.2324 260);--color-kumo-danger:oklch(63.7% 0.237 25.331);--color-kumo-success:oklch(59.6% 0.145 163.225);--color-kumo-focus:oklch(15% 0 0);--color-interstitial-deny:oklch(62% 0.19 25.331);--color-interstitial-approve:oklch(62.7% 0.19 149.214);--text-color-kumo-default:oklch(21% 0.006 285.885);--text-color-kumo-subtle:oklch(55.6% 0 0);--text-color-kumo-placeholder:oklch(70.8% 0 0);--text-color-kumo-link:oklch(42.4% 0.199 265.638);--text-color-kumo-info:oklch(42.4% 0.199 265.638);--text-color-kumo-warning:oklch(47.6% 0.114 61.907);--text-color-kumo-danger:oklch(50.5% 0.213 27.518);--text-color-kumo-success:oklch(43.2% 0.095 166.913);--radius-sm:4px;--radius-md:6px;--radius-lg:8px;--spacing:4px;--content-width:460px;--content-width-wide:540px;--content-width-xl:680px;--page-bg-override:initial}*,::after,::before{-webkit-box-sizing:border-box;box-sizing:border-box}body,html{margin:0;padding:0;min-height:100vh;min-height:100dvh}html{text-rendering:optimizeLegibility;word-wrap:break-word}.Content,body{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}body,html{background:var(--page-bg-override, #003d7b)}body{font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#4f566b;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;padding:calc(var(--spacing)*8) calc(var(--spacing)*2);text-align:center}button{font-family:inherit}.Content{width:100%;max-width:var(--content-width);margin:0 auto;gap:calc(var(--spacing)*5)}.Content-is-wide{max-width:var(--content-width-wide)}.Content-is-xl{max-width:var(--content-width-xl)}.base_AccessLogo{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.Content::after{content:\"\";display:block;height:41px;-ms-flex-negative:0;flex-shrink:0}.base_AccessLogo svg{width:280px;max-width:100%;height:auto;display:block}.AuthBox{width:100%;background:var(--color-kumo-base);border:1px solid var(--color-kumo-hairline);border-radius:var(--radius-lg);overflow:hidden;text-align:left}.AuthBox-body{padding:calc(var(--spacing)*8);display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;gap:calc(var(--spacing)*4)}.AuthBox-body-is-centered,.OrgAvatarLink{-webkit-box-align:center;-ms-flex-align:center;align-items:center}.AuthBox-body-is-centered{text-align:center}.OrgAvatarLink{display:-webkit-box;display:-ms-flexbox;display:flex;gap:calc(var(--spacing)*3);text-decoration:none;color:inherit}.OrgAvatarLink-logo{-ms-flex-negative:0;flex-shrink:0;height:36px}.OrgAvatarLink-logo:has(img[src=\"\"]){display:none}.OrgAvatarLink-logo img{display:block;height:36px;width:auto;border-radius:var(--radius-sm)}.OrgAvatarLink-title{font-size:14px;line-height:20px;font-weight:500;color:var(--text-color-kumo-subtle)}.AuthBox-App{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;gap:var(--spacing)}.Card-title{margin:0;font-size:24px;line-height:32px;font-weight:600;color:var(--text-color-kumo-default)}.AuthBox-body p,.Card-subtitle,.Result p{margin:0;font-size:14px;line-height:20px;color:var(--text-color-kumo-default)}.Header-text{background:var(--color-kumo-tint);border:1px solid var(--color-kumo-hairline);border-radius:var(--radius-md);padding:calc(var(--spacing)*3) calc(var(--spacing)*4);font-size:13px;line-height:18px;color:var(--text-color-kumo-default)}.AuthBox-App>.Header-text{margin-top:calc(var(--spacing)*3)}.AuthBox-text,.InfoRow h3{font-size:14px;line-height:20px;font-weight:500;color:var(--text-color-kumo-default);margin:0 0 2px}.Result{gap:var(--spacing)}.Result p{color:var(--text-color-kumo-subtle)}.InfoList,.InfoRow,.Result{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.InfoList{gap:calc(var(--spacing)*5)}.InfoRow{gap:var(--spacing)}.InfoRow h3{margin:0;font-size:13px;line-height:18px;font-weight:600}.InfoRow p,.StandardInput{font-size:14px;color:var(--text-color-kumo-default)}.InfoRow p{margin:0;line-height:20px}.StandardInput{-moz-appearance:none;appearance:none;-webkit-appearance:none;display:block;width:100%;height:44px;padding:0 calc(var(--spacing)*3);font:inherit;background:var(--color-kumo-control);border:1px solid var(--color-kumo-line);border-radius:var(--radius-lg);-webkit-transition:background-color 120ms ease;transition:background-color 120ms ease}.StandardInput::-webkit-input-placeholder{color:var(--text-color-kumo-placeholder)}.StandardInput::-moz-placeholder{color:var(--text-color-kumo-placeholder)}.StandardInput:-ms-input-placeholder{color:var(--text-color-kumo-placeholder)}.StandardInput::-ms-input-placeholder{color:var(--text-color-kumo-placeholder)}.StandardInput::placeholder{color:var(--text-color-kumo-placeholder)}.AuthFormLogin,.AuthFormLogin-row{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.AuthFormLogin{gap:calc(var(--spacing)*3);margin:0}.AuthFormLogin-row{gap:var(--spacing)}.AuthFormLogin-row label,.Button{font-size:14px;line-height:20px;font-weight:500}.AuthFormLogin-row label{color:var(--text-color-kumo-default);margin-bottom:2px}.AuthFormLogin input[hidden]{display:none}.Button{-moz-appearance:none;appearance:none;-webkit-appearance:none;display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;gap:calc(var(--spacing)*2);height:44px;padding:0 calc(var(--spacing)*4);font-family:inherit;border-radius:var(--radius-lg);border:1px solid transparent;-webkit-box-shadow:0 1px 2px 0 rgba(0,0,0,.05);box-shadow:0 1px 2px 0 rgba(0,0,0,.05);cursor:pointer;text-decoration:none;white-space:nowrap;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;-webkit-transition:background-color 120ms ease,border-color 120ms ease,color 120ms ease,-webkit-box-shadow 120ms ease,-webkit-transform 60ms ease;transition:background-color 120ms ease,border-color 120ms ease,color 120ms ease,box-shadow 120ms ease,transform 60ms ease;transition:background-color 120ms ease,border-color 120ms ease,color 120ms ease,box-shadow 120ms ease,transform 60ms ease,-webkit-box-shadow 120ms ease,-webkit-transform 60ms ease}.Button:focus-visible{outline-offset:2px}.Button:active{-webkit-transform:translateY(.5px);-ms-transform:translateY(.5px);transform:translateY(.5px)}.Button:disabled{opacity:.5;cursor:not-allowed;-webkit-transform:none;-ms-transform:none;transform:none}.Button-is-block{width:100%}.Button-is-destructive,.Button-is-interstitial-approve,.Button-is-interstitial-deny,.Button-is-primary{background:-webkit-gradient(linear,left top,left bottom,from(color-mix(in oklch,var(--button-emphasis-color),white 15%)),to(var(--button-emphasis-color)));background:linear-gradient(to bottom,color-mix(in oklch,var(--button-emphasis-color),white 15%),var(--button-emphasis-color));color:#fff;border-color:color-mix(in oklch,var(--button-emphasis-color),black 10%)}.Button-is-destructive:hover:not(:disabled),.Button-is-interstitial-approve:hover:not(:disabled),.Button-is-interstitial-deny:hover:not(:disabled),.Button-is-primary:hover:not(:disabled){background:-webkit-gradient(linear,left top,left bottom,from(color-mix(in oklch,var(--button-emphasis-color),white 30%)),to(var(--button-emphasis-color)));background:linear-gradient(to bottom,color-mix(in oklch,var(--button-emphasis-color),white 30%),var(--button-emphasis-color))}.Button-is-primary{--button-emphasis-color:var(--color-kumo-brand)}.Button-is-destructive{--button-emphasis-color:var(--color-kumo-danger)}.Button-is-interstitial-deny{--button-emphasis-color:var(--color-interstitial-deny)}.Button-is-interstitial-approve{--button-emphasis-color:var(--color-interstitial-approve)}.Button-is-secondary{background:var(--color-kumo-base);color:var(--text-color-kumo-default);border-color:var(--color-kumo-hairline)}.Button-is-secondary:hover:not(:disabled){background:var(--color-kumo-tint)}.Button-is-secondary:active:not(:disabled){background:var(--color-kumo-fill)}.Button-is-auth{background:var(--color-kumo-base);color:var(--text-color-kumo-default);border-color:var(--color-kumo-hairline);-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start;padding:0 calc(var(--spacing)*4);gap:calc(var(--spacing)*3)}.Button-is-auth:hover:not(:disabled){background:var(--color-kumo-tint)}.Button-is-auth:active:not(:disabled){background:var(--color-kumo-fill)}.Button-is-small{height:26px;padding:0 calc(var(--spacing)*2);gap:calc(var(--spacing)*1);font-size:12px;line-height:16px;border-radius:var(--radius-md)}.Button-auth-service-icon{-ms-flex-negative:0;flex-shrink:0;width:20px;height:20px;display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.Button-auth-service-icon img,.Button-auth-service-icon svg{width:20px;height:20px;display:block}.AuthBoxRow--name{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:14px;font-weight:500}.CardActions{display:-webkit-box;display:-ms-flexbox;display:flex;gap:calc(var(--spacing)*3);margin:0}.CardActions .Button{-webkit-box-flex:1;-ms-flex:1;flex:1}.Footer-text{margin:calc(var(--spacing)*4) calc(var(--spacing)*-8) calc(var(--spacing)*-8);padding:calc(var(--spacing)*4) calc(var(--spacing)*8);background:var(--color-kumo-elevated);border-top:1px solid var(--color-kumo-hairline);font-size:12px;line-height:18px;color:var(--text-color-kumo-subtle);text-align:left}.Footer-text span{white-space:pre-line}.Message,.resend-confirmation{-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start;gap:calc(var(--spacing)*3);padding:calc(var(--spacing)*3) calc(var(--spacing)*4);border:1px solid;border-radius:var(--radius-lg);font-size:14px;line-height:20px;text-align:left}.Message{display:-webkit-box;display:-ms-flexbox;display:flex}.Message svg{-ms-flex-negative:0;flex-shrink:0;width:16px;height:16px;margin-top:2px}.Message svg path{fill:currentColor}.Message-is-info{background:#f4f9ff;border-color:#5b9bd5;color:var(--text-color-kumo-info)}.Message-is-warning{background:#fffef6;border-color:#e6c84a;color:var(--text-color-kumo-warning)}.Message-is-error{background:#fffbfb;border-color:#fd959b;color:var(--text-color-kumo-danger)}.Message-is-success,.resend-confirmation{background:#f8fefb;border-color:#5cb87a;color:var(--text-color-kumo-success)}@media (max-width:480px){body{-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start;padding:calc(var(--spacing)*8) calc(var(--spacing)*4) calc(var(--spacing)*4)}.base_AccessLogo svg{width:220px}.Content::after{display:none}.AuthBox-body{padding:calc(var(--spacing)*5)}.Card-title{font-size:20px}.Footer-text{margin:calc(var(--spacing)*4) calc(var(--spacing)*-5) calc(var(--spacing)*-5);padding:calc(var(--spacing)*3) calc(var(--spacing)*5)}}@media (prefers-reduced-motion:reduce){*,::after,::before{-webkit-transition-duration:.01ms!important;transition-duration:.01ms!important;-webkit-animation-duration:.01ms!important;animation-duration:.01ms!important}}.svg-wrapper{width:96px;position:relative}.svg-wrapper img,.svg-wrapper svg{width:100%;height:auto;display:block}@media (max-width:480px){.svg-wrapper{width:64px}}.svg-wrapper svg{-webkit-transform-origin:bottom;-ms-transform-origin:bottom;transform-origin:bottom;-webkit-animation-delay:800ms;animation-delay:800ms;-webkit-animation:rotate 600ms cubic-bezier(.175,.885,.32,1.275) forwards;animation:rotate 600ms cubic-bezier(.175,.885,.32,1.275) forwards}.svg-wrapper .confetti{width:0;height:0;z-index:10;position:absolute;top:100px;left:60px;-webkit-transform:rotate(-45deg);-ms-transform:rotate(-45deg);transform:rotate(-45deg)}.svg-wrapper .confetti div:nth-of-type(1){height:3px;width:9px;-webkit-transform:translate3d(11px,-84px,0) rotate(20deg);transform:translate3d(11px,-84px,0) rotate(20deg);background:#ec1557}.svg-wrapper .confetti div:nth-of-type(1),.svg-wrapper .confetti div:nth-of-type(2),.svg-wrapper .confetti div:nth-of-type(3),.svg-wrapper .confetti div:nth-of-type(4){position:absolute;-webkit-animation-delay:600ms;animation-delay:600ms;-webkit-animation:bang 1000ms cubic-bezier(.175,.885,.32,1.275) forwards;animation:bang 1000ms cubic-bezier(.175,.885,.32,1.275) forwards}.svg-wrapper .confetti div:nth-of-type(2){height:10px;width:4px;-webkit-transform:translate3d(-10px,-136px,0) rotate(85deg);transform:translate3d(-10px,-136px,0) rotate(85deg);background:#f16137}.svg-wrapper .confetti div:nth-of-type(3),.svg-wrapper .confetti div:nth-of-type(4){height:9px;width:8px;-webkit-transform:translate3d(6px,-126px,0) rotate(34deg);transform:translate3d(6px,-126px,0) rotate(34deg);background:#276cac}.svg-wrapper .confetti div:nth-of-type(4){height:8px;-webkit-transform:translate3d(7px,-61px,0) rotate(48deg);transform:translate3d(7px,-61px,0) rotate(48deg)}.svg-wrapper .confetti div:nth-of-type(5){height:5px;width:4px;-webkit-transform:translate3d(2px,-93px,0) rotate(5deg);transform:translate3d(2px,-93px,0) rotate(5deg);background:#f0b636}.svg-wrapper .confetti div:nth-of-type(5),.svg-wrapper .confetti div:nth-of-type(6),.svg-wrapper .confetti div:nth-of-type(7),.svg-wrapper .confetti div:nth-of-type(8){position:absolute;-webkit-animation-delay:600ms;animation-delay:600ms;-webkit-animation:bang 1000ms cubic-bezier(.175,.885,.32,1.275) forwards;animation:bang 1000ms cubic-bezier(.175,.885,.32,1.275) forwards}.svg-wrapper .confetti div:nth-of-type(6){height:8px;width:7px;-webkit-transform:translate3d(6px,-148px,0) rotate(15deg);transform:translate3d(6px,-148px,0) rotate(15deg);background:#276cac}.svg-wrapper .confetti div:nth-of-type(7),.svg-wrapper .confetti div:nth-of-type(8){height:5px;width:5px;-webkit-transform:translate3d(-32px,-97px,0) rotate(2deg);transform:translate3d(-32px,-97px,0) rotate(2deg);background:#ec1557}.svg-wrapper .confetti div:nth-of-type(8){height:7px;width:3px;-webkit-transform:translate3d(-17px,-74px,0) rotate(19deg);transform:translate3d(-17px,-74px,0) rotate(19deg)}.svg-wrapper .confetti div:nth-of-type(9){height:5px;width:7px;-webkit-transform:translate3d(-29px,-150px,0) rotate(24deg);transform:translate3d(-29px,-150px,0) rotate(24deg);background:#276cac}.svg-wrapper .confetti div:nth-of-type(10),.svg-wrapper .confetti div:nth-of-type(11),.svg-wrapper .confetti div:nth-of-type(9){position:absolute;-webkit-animation-delay:600ms;animation-delay:600ms;-webkit-animation:bang 1000ms cubic-bezier(.175,.885,.32,1.275) forwards;animation:bang 1000ms cubic-bezier(.175,.885,.32,1.275) forwards}.svg-wrapper .confetti div:nth-of-type(10){height:7px;width:10px;-webkit-transform:translate3d(-36px,-118px,0) rotate(56deg);transform:translate3d(-36px,-118px,0) rotate(56deg);background:#276cac}.svg-wrapper .confetti div:nth-of-type(11){height:9px;width:3px;-webkit-transform:translate3d(2px,-124px,0) rotate(66deg);transform:translate3d(2px,-124px,0) rotate(66deg);background:#f16137}.svg-wrapper .confetti div:nth-of-type(12){height:10px;width:8px;-webkit-transform:translate3d(-39px,-85px,0) rotate(70deg);transform:translate3d(-39px,-85px,0) rotate(70deg);background:#ec1557}.svg-wrapper .confetti div:nth-of-type(12),.svg-wrapper .confetti div:nth-of-type(13),.svg-wrapper .confetti div:nth-of-type(14),.svg-wrapper .confetti div:nth-of-type(15){position:absolute;-webkit-animation-delay:600ms;animation-delay:600ms;-webkit-animation:bang 1000ms cubic-bezier(.175,.885,.32,1.275) forwards;animation:bang 1000ms cubic-bezier(.175,.885,.32,1.275) forwards}.svg-wrapper .confetti div:nth-of-type(13){height:8px;width:4px;-webkit-transform:translate3d(-36px,-63px,0) rotate(58deg);transform:translate3d(-36px,-63px,0) rotate(58deg);background:#ec1557}.svg-wrapper .confetti div:nth-of-type(14),.svg-wrapper .confetti div:nth-of-type(15){height:10px;width:6px;-webkit-transform:translate3d(1px,-78px,0) rotate(86deg);transform:translate3d(1px,-78px,0) rotate(86deg);background:#276cac}.svg-wrapper .confetti div:nth-of-type(15){height:3px;width:8px;-webkit-transform:translate3d(12px,-99px,0) rotate(8deg);transform:translate3d(12px,-99px,0) rotate(8deg)}@media screen and (max-width:480px){.svg-wrapper .confetti{top:75px;left:40px}.svg-wrapper .confetti div:nth-of-type(1){height:6px;width:5px;-webkit-transform:translate3d(10px,-83px,0) rotate(24deg);transform:translate3d(10px,-83px,0) rotate(24deg)}.svg-wrapper .confetti div:nth-of-type(2){height:3px;width:5px;-webkit-transform:translate3d(-30px,-80px,0) rotate(49deg);transform:translate3d(-30px,-80px,0) rotate(49deg)}.svg-wrapper .confetti div:nth-of-type(3){height:5px;width:5px;-webkit-transform:translate3d(15px,-73px,0) rotate(27deg);transform:translate3d(15px,-73px,0) rotate(27deg)}.svg-wrapper .confetti div:nth-of-type(4){height:3px;width:6px;-webkit-transform:translate3d(-41px,-55px,0) rotate(44deg);transform:translate3d(-41px,-55px,0) rotate(44deg)}.svg-wrapper .confetti div:nth-of-type(5){height:4px;width:4px;-webkit-transform:translate3d(11px,-61px,0) rotate(1deg);transform:translate3d(11px,-61px,0) rotate(1deg)}.svg-wrapper .confetti div:nth-of-type(6){height:6px;width:4px;-webkit-transform:translate3d(20px,-57px,0) rotate(85deg);transform:translate3d(20px,-57px,0) rotate(85deg)}.svg-wrapper .confetti div:nth-of-type(7){height:3px;width:5px;-webkit-transform:translate3d(-8px,-58px,0) rotate(45deg);transform:translate3d(-8px,-58px,0) rotate(45deg)}.svg-wrapper .confetti div:nth-of-type(8){height:3px;width:4px;-webkit-transform:translate3d(-10px,-49px,0) rotate(65deg);transform:translate3d(-10px,-49px,0) rotate(65deg)}.svg-wrapper .confetti div:nth-of-type(9){height:5px;width:3px;-webkit-transform:translate3d(7px,-38px,0) rotate(7deg);transform:translate3d(7px,-38px,0) rotate(7deg)}.svg-wrapper .confetti div:nth-of-type(10){height:6px;width:6px;-webkit-transform:translate3d(3px,-58px,0) rotate(90deg);transform:translate3d(3px,-58px,0) rotate(90deg)}.svg-wrapper .confetti div:nth-of-type(11){height:3px;width:5px;-webkit-transform:translate3d(-11px,-88px,0) rotate(79deg);transform:translate3d(-11px,-88px,0) rotate(79deg)}.svg-wrapper .confetti div:nth-of-type(12){height:6px;width:6px;-webkit-transform:translate3d(8px,-63px,0) rotate(77deg);transform:translate3d(8px,-63px,0) rotate(77deg)}.svg-wrapper .confetti div:nth-of-type(13){height:6px;width:5px;-webkit-transform:translate3d(4px,-48px,0) rotate(79deg);transform:translate3d(4px,-48px,0) rotate(79deg)}.svg-wrapper .confetti div:nth-of-type(14){height:5px;width:5px;-webkit-transform:translate3d(-27px,-54px,0) rotate(38deg);transform:translate3d(-27px,-54px,0) rotate(38deg)}.svg-wrapper .confetti div:nth-of-type(15){height:6px;width:5px;-webkit-transform:translate3d(24px,-44px,0) rotate(26deg);transform:translate3d(24px,-44px,0) rotate(26deg)}}.AuthBox-Normal,.js-login-view,.js-passkey-view{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;gap:calc(var(--spacing)*4)}.js-login-view[hidden],.js-passkey-view[hidden]{display:none}.PasskeyManagement .passkeys-heading{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start;gap:calc(var(--spacing)*3);margin-bottom:calc(var(--spacing)*10)}.PasskeyManagement .passkeys-heading>div{display:grid;gap:calc(var(--spacing)*2)}.PasskeyManagement .passkeys-heading h1,.PasskeyManagement .passkeys-heading p{margin:0}.PasskeyManagement .passkeys-heading p{color:#62656c;overflow-wrap:anywhere}.PasskeyManagement .passkeys-heading h1{line-height:1.2}.PasskeyManagement .passkeys-add{-webkit-box-flex:0;-ms-flex:none;flex:none;display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;width:40px;height:40px;-webkit-box-sizing:border-box;box-sizing:border-box;padding:0;border-radius:50%;text-decoration:none}.PasskeyManagement .passkeys-add svg{width:20px;height:20px}.PasskeyManagement .passkeys-details,.PasskeyManagement .passkeys-empty,.PasskeyManagement .passkeys-list{display:grid;gap:calc(var(--spacing)*2)}.PasskeyManagement .passkeys-item{border:1px solid #dedede;border-radius:6px;padding:calc(var(--spacing)*4)}.PasskeyManagement .passkeys-row{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;gap:calc(var(--spacing)*2)}.PasskeyManagement .passkeys-confirm-delete{display:grid;gap:calc(var(--spacing)*3);margin-top:calc(var(--spacing)*4);padding-top:calc(var(--spacing)*4);border-top:1px solid var(--color-kumo-hairline)}.PasskeyManagement .passkeys-confirm-actions{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;gap:calc(var(--spacing)*2)}.PasskeyManagement .passkeys-details{min-width:0;-webkit-box-flex:1;-ms-flex:1;flex:1;overflow-wrap:anywhere}.PasskeyManagement .passkeys-details form{gap:calc(var(--spacing)*2)}.PasskeyManagement .passkeys-actions{gap:calc(var(--spacing)*2);-ms-flex-wrap:wrap;flex-wrap:wrap}.PasskeyManagement .passkeys-details input{min-width:0;-webkit-box-flex:1;-ms-flex:1;flex:1}.PasskeyManagement .passkeys-details form,.PasskeyManagement .passkeys-meta{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap}.PasskeyManagement .passkeys-meta{-webkit-column-gap:calc(var(--spacing)*3);-moz-column-gap:calc(var(--spacing)*3);column-gap:calc(var(--spacing)*3);font-size:13px;color:#62656c}.PasskeyManagement .passkeys-meta span{white-space:nowrap}.PasskeyManagement .passkeys-actions{-webkit-box-flex:0;-ms-flex:none;flex:none;display:-webkit-box;display:-ms-flexbox;display:flex;gap:var(--spacing)}.PasskeyManagement .passkeys-action{display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;width:36px;height:36px;padding:0;border:0;border-radius:var(--radius-lg);background:0 0;color:#62656c;cursor:pointer}.PasskeyManagement .passkeys-action:hover{background:var(--color-kumo-tint);color:var(--text-color-kumo-default)}.PasskeyManagement .passkeys-action-delete:hover{color:var(--color-kumo-danger)}.PasskeyManagement .passkeys-action:focus-visible{outline:2px solid var(--color-kumo-brand)}.PasskeyManagement .passkeys-action:disabled{opacity:.5;cursor:not-allowed}.PasskeyManagement .passkeys-action svg{width:18px;height:18px}.PasskeyManagement .passkeys-back{margin-top:calc(var(--spacing)*6)}.PasskeyManagement .passkeys-empty{padding:calc(var(--spacing)*6)0;text-align:center;color:#62656c}.PasskeyManagement .passkeys-empty p{margin:0}.PasskeyManagement .passkeys-error{margin-bottom:calc(var(--spacing)*4);border:1px solid #e5a6a6;border-radius:6px;padding:calc(var(--spacing)*3);background:#fff4f4;color:#8d2020}.PasskeyManagementLink{text-align:center}.AuthBox-AuthGroup{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;gap:var(--spacing)}.AuthBox-AuthGroup,.AuthServiceLogin,.kumo-divider{display:-webkit-box;display:-ms-flexbox;display:flex}.AuthServiceLogin{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;gap:calc(var(--spacing)*2)}.kumo-divider{-webkit-box-align:center;-ms-flex-align:center;align-items:center;gap:calc(var(--spacing)*3);color:var(--text-color-kumo-subtle)}.kumo-divider::after,.kumo-divider::before{content:\"\";-webkit-box-flex:1;-ms-flex:1;flex:1;height:1px;background:var(--color-kumo-hairline)}.kumo-divider__label{font-size:13px;line-height:18px;font-weight:500}.AuthBox-RequestCode{gap:calc(var(--spacing)*2)}.AuthBox-RequestCode,.PasskeyEnrollment,.PasskeyEnrollment-header{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.PasskeyEnrollment{gap:calc(var(--spacing)*6);padding:calc(var(--spacing)*2)0}.PasskeyEnrollment-header{-webkit-box-align:center;-ms-flex-align:center;align-items:center;gap:calc(var(--spacing)*2);text-align:center}.PasskeyEnrollment-visual{width:80px;margin-bottom:calc(var(--spacing)*2)}.PasskeyEnrollment-visual-is-success{width:96px}@media (max-width:480px){.PasskeyEnrollment-visual-is-success{width:64px}}.PasskeyEnrollment-visual[hidden]{display:none}.PasskeyEnrollment-visual svg{display:block;width:100%;height:auto}.PasskeyEnrollment .Card-subtitle{color:var(--text-color-kumo-subtle);overflow-wrap:anywhere}.PasskeyEnrollment-actions{margin-top:calc(var(--spacing)*2)}</style>\n\n \n <script>!function(e){\"use strict\";function t(t){return!!t&&(\"Symbol\"in e&&\"iterator\"in e.Symbol&&\"function\"==typeof t[Symbol.iterator]||!!Array.isArray(t))}function n(e){return\"from\"in Array?Array.from(e):Array.prototype.slice.call(e)}!function(){var r,a=e.URL;try{if(a){if(\"searchParams\"in(r=new e.URL(\"http://example.com\")))return;\"href\"in r||(r=void 0)}}catch(e){}function i(e){var t=\"\",n=!0;return e.forEach(function(e){var r=encodeURIComponent(e.name),a=encodeURIComponent(e.value);n||(t+=\"&\"),t+=r+\"=\"+a,n=!1}),t.replace(/%20/g,\"+\")}function o(e,t){var n=e.split(\"&\");t&&-1===n[0].indexOf(\"=\")&&(n[0]=\"=\"+n[0]);var r=[];n.forEach(function(e){if(0!==e.length){var t=e.indexOf(\"=\");if(-1!==t)var n=e.substring(0,t),a=e.substring(t+1);else n=e,a=\"\";n=n.replace(/\\+/g,\" \"),a=a.replace(/\\+/g,\" \"),r.push({name:n,value:a})}});var a=[];return r.forEach(function(e){a.push({name:decodeURIComponent(e.name),value:decodeURIComponent(e.value)})}),a}function u(e){var r=this;this._list=[],null==e||(e instanceof u?this._list=o(String(e)):\"object\"==typeof e&&t(e)?n(e).forEach(function(e){if(!t(e))throw TypeError();var a=n(e);if(2!==a.length)throw TypeError();r._list.push({name:String(a[0]),value:String(a[1])})}):\"object\"==typeof e&&e?Object.keys(e).forEach(function(t){r._list.push({name:String(t),value:String(e[t])})}):(\"?\"===(e=String(e)).substring(0,1)&&(e=e.substring(1)),this._list=o(e))),this._url_object=null,this._setList=function(e){a||(r._list=e)};var a=!1;this._update_steps=function(){a||(a=!0,r._url_object&&(\"about:\"===r._url_object.protocol&&-1!==r._url_object.pathname.indexOf(\"?\")&&(r._url_object.pathname=r._url_object.pathname.split(\"?\")[0]),r._url_object.search=i(r._list),a=!1))}}function l(e,t){var n=0;this.next=function(){if(n>=e.length)return{done:!0,value:void 0};var r=e[n++];return{done:!1,value:\"key\"===t?r.name:\"value\"===t?r.value:[r.name,r.value]}}}function c(t,n){if(!(this instanceof e.URL))throw new TypeError(\"Failed to construct 'URL': Please use the 'new' operator.\");n&&(t=function(){if(r)return new a(t,n).href;var e;try{var i;if(\"[object OperaMini]\"===Object.prototype.toString.call(window.operamini)?((e=document.createElement(\"iframe\")).style.display=\"none\",document.documentElement.appendChild(e),i=e.contentWindow.document):document.implementation&&document.implementation.createHTMLDocument?i=document.implementation.createHTMLDocument(\"\"):document.implementation&&document.implementation.createDocument?((i=document.implementation.createDocument(\"http://www.w3.org/1999/xhtml\",\"html\",null)).documentElement.appendChild(i.createElement(\"head\")),i.documentElement.appendChild(i.createElement(\"body\"))):window.ActiveXObject&&((i=new window.ActiveXObject(\"htmlfile\")).write(\"<head></head><body></body>\"),i.close()),!i)throw Error(\"base not supported\");var o=i.createElement(\"base\");o.href=n,i.getElementsByTagName(\"head\")[0].appendChild(o);var u=i.createElement(\"a\");return u.href=t,u.href}finally{e&&e.parentNode.removeChild(e)}}());var i=function(e){if(r)return new a(e);var t=document.createElement(\"a\");return t.href=e,t}(t||\"\"),l=function(){if(!(\"defineProperties\"in Object))return!1;try{var e={};return Object.defineProperties(e,{prop:{get:function(){return!0}}}),e.prop}catch(e){return!1}}()?this:document.createElement(\"a\"),c=new u(i.search?i.search.substring(1):null);function s(){var e=i.href.replace(/#$|\\?$|\\?(?=#)/g,\"\");i.href!==e&&(i.href=e)}function f(){c._setList(i.search?o(i.search.substring(1)):[]),c._update_steps()}return c._url_object=l,Object.defineProperties(l,{href:{get:function(){return i.href},set:function(e){i.href=e,s(),f()},enumerable:!0,configurable:!0},origin:{get:function(){return\"origin\"in i?i.origin:this.protocol+\"//\"+this.host},enumerable:!0,configurable:!0},protocol:{get:function(){return i.protocol},set:function(e){i.protocol=e},enumerable:!0,configurable:!0},username:{get:function(){return i.username},set:function(e){i.username=e},enumerable:!0,configurable:!0},password:{get:function(){return i.password},set:function(e){i.password=e},enumerable:!0,configurable:!0},host:{get:function(){var e={\"http:\":/:80$/,\"https:\":/:443$/,\"ftp:\":/:21$/}[i.protocol];return e?i.host.replace(e,\"\"):i.host},set:function(e){i.host=e},enumerable:!0,configurable:!0},hostname:{get:function(){return i.hostname},set:function(e){i.hostname=e},enumerable:!0,configurable:!0},port:{get:function(){return i.port},set:function(e){i.port=e},enumerable:!0,configurable:!0},pathname:{get:function(){return\"/\"!==i.pathname.charAt(0)?\"/\"+i.pathname:i.pathname},set:function(e){i.pathname=e},enumerable:!0,configurable:!0},search:{get:function(){return i.search},set:function(e){i.search!==e&&(i.search=e,s(),f())},enumerable:!0,configurable:!0},searchParams:{get:function(){return c},enumerable:!0,configurable:!0},hash:{get:function(){return i.hash},set:function(e){i.hash=e,s()},enumerable:!0,configurable:!0},toString:{value:function(){return i.toString()},enumerable:!1,configurable:!0},valueOf:{value:function(){return i.valueOf()},enumerable:!1,configurable:!0}}),l}if(Object.defineProperties(u.prototype,{append:{value:function(e,t){this._list.push({name:e,value:t}),this._update_steps()},writable:!0,enumerable:!0,configurable:!0},delete:{value:function(e){for(var t=0;t<this._list.length;)this._list[t].name===e?this._list.splice(t,1):++t;this._update_steps()},writable:!0,enumerable:!0,configurable:!0},get:{value:function(e){for(var t=0;t<this._list.length;++t)if(this._list[t].name===e)return this._list[t].value;return null},writable:!0,enumerable:!0,configurable:!0},getAll:{value:function(e){for(var t=[],n=0;n<this._list.length;++n)this._list[n].name===e&&t.push(this._list[n].value);return t},writable:!0,enumerable:!0,configurable:!0},has:{value:function(e){for(var t=0;t<this._list.length;++t)if(this._list[t].name===e)return!0;return!1},writable:!0,enumerable:!0,configurable:!0},set:{value:function(e,t){for(var n=!1,r=0;r<this._list.length;)this._list[r].name===e?n?this._list.splice(r,1):(this._list[r].value=t,n=!0,++r):++r;n||this._list.push({name:e,value:t}),this._update_steps()},writable:!0,enumerable:!0,configurable:!0},entries:{value:function(){return new l(this._list,\"key+value\")},writable:!0,enumerable:!0,configurable:!0},keys:{value:function(){return new l(this._list,\"key\")},writable:!0,enumerable:!0,configurable:!0},values:{value:function(){return new l(this._list,\"value\")},writable:!0,enumerable:!0,configurable:!0},forEach:{value:function(e){var t=arguments.length>1?arguments[1]:void 0;this._list.forEach(function(n,r){e.call(t,n.value,n.name)})},writable:!0,enumerable:!0,configurable:!0},toString:{value:function(){return i(this._list)},writable:!0,enumerable:!1,configurable:!0}}),\"Symbol\"in e&&\"iterator\"in e.Symbol&&(Object.defineProperty(u.prototype,e.Symbol.iterator,{value:u.prototype.entries,writable:!0,enumerable:!0,configurable:!0}),Object.defineProperty(l.prototype,e.Symbol.iterator,{value:function(){return this},writable:!0,enumerable:!0,configurable:!0})),a)for(var s in a)a.hasOwnProperty(s)&&\"function\"==typeof a[s]&&(c[s]=a[s]);e.URL=c,e.URLSearchParams=u}(),function(){if(\"1\"!==new e.URLSearchParams([[\"a\",1]]).get(\"a\")||\"1\"!==new e.URLSearchParams({a:1}).get(\"a\")){var r=e.URLSearchParams;e.URLSearchParams=function(e){if(e&&\"object\"==typeof e&&t(e)){var a=new r;return n(e).forEach(function(e){if(!t(e))throw TypeError();var r=n(e);if(2!==r.length)throw TypeError();a.append(r[0],r[1])}),a}return e&&\"object\"==typeof e?(a=new r,Object.keys(e).forEach(function(t){a.set(t,e[t])}),a):new r(e)}}}()}(self);</script>\n <script>\"use strict\";var get=function(t){return Array.prototype.slice.call(document.querySelectorAll(t))},addFragmentToURLState=function(t){if(!t)return t;var e=new URL(t);if(e&&\"\"!==fragment&&fragment.length<100){var a=window.btoa(JSON.stringify({fragment:\"#\"===fragment[0]?fragment:\"#\".concat(fragment)})),r=e.searchParams.get(\"state\"),n=e.searchParams.get(\"RelayState\");r?e.searchParams.set(\"state\",\"\".concat(r,\".\").concat(a)):n&&e.searchParams.set(\"RelayState\",\"\".concat(n,\".\").concat(a))}return e.toString()},fragment=window.location.hash||\"\",article=document.querySelector(\"#data\"),dset=article.dataset,autoRedirectToIdentity=\"true\"===dset.autoRedirectToIdentity,autoRedirectURL=addFragmentToURLState(dset.autoRedirectUrl),message=dset.message;autoRedirectURL&&autoRedirectToIdentity&&(message||(window.location=autoRedirectURL));</script>\n </head>\n\n <body>\n <div class=\"Content\">\n <div class=\"base_AccessLogo\">\n <svg width=\"339\" height=\"50\" fill=\"none\" viewBox=\"0 0 339 50\"><path d=\"M42.8 2.847A20.9 20.9 0 0 0 30.343 6.97a21.6 21.6 0 0 0-7.703 10.806l-.14.449h3.9l.09-.215a17.76 17.76 0 0 1 7.47-8.88 17.2 17.2 0 0 1 11.254-2.255 17.38 17.38 0 0 1 10.206 5.342 18.02 18.02 0 0 1 4.772 10.642c.374 3.993-.58 8-2.71 11.372a17.56 17.56 0 0 1-9.03 7.217 17.17 17.17 0 0 1-11.469-.038A17.57 17.57 0 0 1 28 34.133c-.1-.153-.19-.306-.28-.47l-.2-.357h-4.09l.24.5q.556 1.22 1.27 2.347a21.4 21.4 0 0 0 8.002 7.497 20.86 20.86 0 0 0 10.59 2.47 20.9 20.9 0 0 0 10.4-3.203 21.47 21.47 0 0 0 7.481-8.038 22 22 0 0 0 2.6-10.763 22 22 0 0 0-2.962-10.664 21.4 21.4 0 0 0-7.75-7.77A20.9 20.9 0 0 0 42.8 2.848\" fill=\"#fff\"/><path d=\"m43.79 21.52-7.43-7.581-2.47 2.52 4.32 4.419H6l2.08 3.56H42.6zM43.74 37.602l-2.47-2.52 4.32-4.419H11.7l-2.07-3.57h40.35l1.19 2.928zM327.359 19.158q1.95 1.248 2.239 4.295h-4.341q-.091-.837-.472-1.325-.717-.883-2.438-.883-1.416 0-2.026.441-.594.442-.594 1.036 0 .746.64 1.082.64.35 4.524 1.203 2.59.609 3.885 1.843 1.28 1.25 1.279 3.123 0 2.467-1.843 4.037-1.828 1.554-5.667 1.554-3.915 0-5.788-1.646-1.859-1.66-1.859-4.22h4.403q.137 1.159.594 1.646.807.868 2.986.868 1.28 0 2.025-.38.762-.381.762-1.143 0-.73-.609-1.112-.609-.38-4.524-1.31-2.818-.7-3.976-1.752-1.158-1.036-1.158-2.985 0-2.3 1.798-3.946 1.812-1.66 5.087-1.66 3.108 0 5.073 1.234M310.929 19.158q1.95 1.248 2.24 4.295h-4.342q-.091-.837-.472-1.325-.716-.883-2.437-.883-1.417 0-2.026.441-.594.442-.594 1.036 0 .746.639 1.082.64.35 4.525 1.203 2.59.609 3.884 1.843 1.28 1.25 1.28 3.123 0 2.467-1.844 4.037-1.827 1.554-5.666 1.554-3.915 0-5.789-1.646-1.858-1.66-1.858-4.22h4.402q.137 1.159.594 1.646.808.868 2.986.868 1.28 0 2.026-.38.761-.381.761-1.143 0-.73-.609-1.112-.609-.38-4.524-1.31-2.818-.7-3.976-1.752-1.158-1.036-1.158-2.985 0-2.3 1.798-3.946 1.812-1.66 5.088-1.66 3.107 0 5.072 1.234M297.272 30.125q-.167 1.478-1.538 3.001-2.133 2.422-5.971 2.422-3.169 0-5.591-2.041t-2.422-6.642q0-4.31 2.178-6.61 2.195-2.3 5.682-2.3 2.072 0 3.732.776 1.66.777 2.742 2.452.975 1.479 1.265 3.428.167 1.142.137 3.29h-11.364q.091 2.499 1.569 3.504.898.624 2.163.624 1.341 0 2.178-.761.457-.411.808-1.143zm-4.295-5.088q-.107-1.72-1.051-2.604-.93-.9-2.316-.9-1.507 0-2.346.945-.822.945-1.035 2.56zM280.997 24.352h-4.448a3.9 3.9 0 0 0-.625-1.675q-.73-1.006-2.27-1.006-2.193 0-3.001 2.178-.426 1.158-.426 3.078 0 1.827.426 2.94.777 2.07 2.925 2.071 1.524 0 2.163-.822.64-.823.777-2.133h4.433q-.153 1.98-1.432 3.747-2.042 2.85-6.047 2.849-4.006 0-5.896-2.376-1.888-2.377-1.888-6.17 0-4.28 2.086-6.657Q269.862 18 273.532 18q3.123 0 5.104 1.401 1.995 1.402 2.361 4.951M264.567 24.352h-4.448a3.85 3.85 0 0 0-.625-1.675q-.731-1.006-2.269-1.006-2.194 0-3.001 2.178-.427 1.158-.427 3.078 0 1.827.427 2.94.777 2.07 2.924 2.071 1.524 0 2.164-.822.64-.823.776-2.133h4.433q-.152 1.98-1.432 3.747-2.04 2.85-6.047 2.849t-5.895-2.376q-1.89-2.377-1.889-6.17 0-4.28 2.087-6.657Q253.431 18 257.103 18q3.123 0 5.103 1.401 1.995 1.402 2.361 4.951M242.09 30.384h-8.272L232.264 35h-4.905l8.013-22.454h5.301L248.625 35h-5.088zm-1.31-3.869-2.803-8.835-2.895 8.835zM219.788 30.125q-.168 1.478-1.539 3.001-2.132 2.422-5.971 2.422-3.168 0-5.59-2.041t-2.422-6.642q0-4.31 2.178-6.61 2.193-2.3 5.682-2.3 2.071 0 3.732.776 1.66.777 2.742 2.452.975 1.479 1.264 3.428.168 1.142.137 3.29h-11.364q.091 2.499 1.569 3.504.9.624 2.164.624 1.34 0 2.178-.761.457-.411.807-1.143zm-4.296-5.088q-.106-1.72-1.051-2.604-.929-.9-2.315-.9-1.508 0-2.346.945-.822.945-1.036 2.56zM202.702 22.402q-2.62 0-3.519 1.706-.503.96-.503 2.956V35h-4.371V18.396h4.143v2.894q1.005-1.66 1.752-2.27 1.218-1.02 3.168-1.02.121 0 .198.015.091 0 .381.015v4.448a12 12 0 0 0-1.249-.076M178.549 20.194q1.72-2.194 5.91-2.194 2.727 0 4.844 1.081 2.118 1.082 2.118 4.083v7.616q0 .792.03 1.92.045.853.259 1.157.213.306.64.503V35h-4.722a4.8 4.8 0 0 1-.275-.944 12 12 0 0 1-.122-1.006 9 9 0 0 1-2.071 1.66q-1.402.808-3.169.808-2.254 0-3.732-1.28-1.462-1.294-1.462-3.656 0-3.06 2.361-4.432 1.295-.747 3.808-1.067l1.478-.182q1.203-.153 1.721-.381.93-.396.929-1.234 0-1.02-.716-1.402-.7-.396-2.071-.396-1.539 0-2.179.762-.456.564-.609 1.523h-4.189q.137-2.178 1.219-3.58m3.229 11.668q.61.503 1.493.503 1.401 0 2.574-.823 1.189-.823 1.234-3v-1.616a5 5 0 0 1-.838.427 7.3 7.3 0 0 1-1.142.29l-.975.182q-1.371.244-1.965.594-1.005.594-1.005 1.843 0 1.113.624 1.6M167.682 12.41v3.534q-.306-.015-.595-.015-.288-.015-.7-.016-1.021 0-1.249.564-.23.564-.198 1.767v.305h2.848v3.061h-2.848V35h-4.327V21.61h-2.422V18.55h2.377v-1.067q0-2.65 1.173-3.945 1.05-1.218 4.28-1.219.396 0 .807.03.412.031.854.062m7.007.137V35h-4.326V12.547zM156.763 12.577V35h-4.219v-2.3q-.93 1.477-2.118 2.148-1.188.67-2.955.67-2.909 0-4.905-2.346-1.98-2.361-1.98-6.047 0-4.25 1.95-6.688Q144.501 18 147.776 18q1.508 0 2.681.67a5.2 5.2 0 0 1 1.904 1.828v-7.92zm-11.699 14.228q0 2.3.914 3.67.9 1.387 2.742 1.387t2.803-1.37q.96-1.372.96-3.55 0-3.046-1.539-4.357a3.3 3.3 0 0 0-2.193-.792q-1.905 0-2.803 1.447-.884 1.432-.884 3.565M134.164 32.654q-.06.075-.304.457a3 3 0 0 1-.579.67q-1.021.915-1.981 1.25-.944.334-2.224.334-3.685 0-4.966-2.65-.715-1.463-.715-4.31V18.395h4.448v10.008q0 1.417.335 2.133.594 1.264 2.33 1.264 2.225 0 3.047-1.797.426-.976.426-2.575v-9.033h4.403V35h-4.22zM119.227 20.498q2.102 2.636 2.102 6.23 0 3.657-2.102 6.261-2.102 2.59-6.383 2.59-4.28 0-6.382-2.59-2.103-2.604-2.103-6.26 0-3.596 2.103-6.23 2.101-2.636 6.382-2.636t6.383 2.635m-6.398 1.036q-1.905 0-2.94 1.356-1.02 1.34-1.021 3.838t1.021 3.854q1.035 1.356 2.94 1.356 1.903 0 2.925-1.356 1.02-1.356 1.02-3.854t-1.02-3.838q-1.022-1.356-2.925-1.356M97.727 12.546h4.341V35h-4.341zM92.22 33.324q-2.514 2.3-6.429 2.3-4.844 0-7.616-3.107-2.773-3.123-2.773-8.56 0-5.88 3.154-9.064 2.742-2.773 6.976-2.773 5.667 0 8.287 3.717 1.448 2.087 1.554 4.189H90.68q-.457-1.614-1.173-2.437-1.28-1.463-3.793-1.463-2.56 0-4.037 2.072-1.477 2.057-1.477 5.834 0 3.778 1.553 5.667 1.57 1.875 3.976 1.874 2.468 0 3.763-1.615.716-.868 1.188-2.605h4.646q-.609 3.671-3.108 5.971\" fill=\"#fff\"/></svg>\n </div>\n\n <div class=\"AuthBox\">\n <div class=\"AuthBox-body\">\n <a class=\"OrgAvatarLink\" href=''>\n <div class=\"OrgAvatarLink-logo\">\n <img src=\"https://s.cystack.net/resource/cystack/CyStack-Black.svg\" style=\"opacity:0;\" onload=\"this.style.opacity='1'\">\n </div>\n <div class=\"OrgAvatarLink-title\">\n CyStack\n </div>\n </a>\n <div class=\"AuthBox-App\">\n <h1 class=\"Card-title\">\n Log in to CyStack Blog\n </h1>\n\n </div>\n <div class=\"AuthBox-Normal\" >\n <div class=\"js-login-view\">\n <div class=\"AuthBox-AuthGroup\">\n <div class=\"AuthBox-text\">\n Sign in with:\n </div>\n <div class=\"AuthServiceLogin\">\n <div class=\"AuthServiceLogin-row AuthServiceLogin-row-is-only\">\n <a class=\"Button-is-block Button Button-is-auth js-idp\" data-idp=\"Google\" title=\"Google ・ CyStack\"\n href=\"https://accounts.google.com/o/oauth2/auth?client_id=306229843697-8ot9f4phmrpr35gahbe3cvf5agj6nhs6.apps.googleusercontent.com&redirect_uri=https%3A%2F%2Fcystack.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&state=01124354f75e9ae81ecba709292a86fc02e31aa6a4d8df8207d5f1e2495587f9.JTdCJTIyaWF0JTIyJTNBMTc5Mjc2MDA5MSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJjeXN0YWNrLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJibG9nLmN5c3RhY2sub3JnJTIyJTJDJTIycmVkaXJlY3RVUkwlMjIlM0ElMjIlMkZsYWJzJTJGd3AtanNvbiUyRndwJTJGcmFua21hdGglMkZ2MSUyRmdldEhlYWQlM0Z1cmwlM0RodHRwcyUzQSUyNTJGJTI1MkZibG9nLmN5c3RhY2sub3JnJTI1MkZsYWJzJTI1MkYyMDI2JTI1MkYxMCUyNTJGMjIlMjUyRnBocDJzaGVsbC12dWxuZXJhYmlsaXR5JTI1MkYlMjIlMkMlMjJhdWQlMjIlM0ElMjJkMDhjYzMxMmQzNTgwMjY4ZGYzYWNhMjRjYjRmNGI3NDZhYTU1OGVkMGEzODRjYjRkNzNkZDc2OGViMDIwMWY3JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm56WTZNNHdGbTZMUmRkVEZkJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI4OTM1NTNmNi0yMDVjLTRjY2MtOWMxZS1jMzA5NDhlN2Y4NWMlMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX3N0YXR1cyUyMiUzQWZhbHNlJTJDJTIyYXV0aF9zdGF0dXMlMjIlM0ElMjJOT05FJTIyJTJDJTIyaXNfd2FycCUyMiUzQWZhbHNlJTJDJTIyaXNfZ2F0ZXdheSUyMiUzQWZhbHNlJTJDJTIybXRsc19hdXRoJTIyJTNBJTdCJTIyY2VydF9pc3N1ZXJfZG4lMjIlM0ElMjIlMjIlMkMlMjJjZXJ0X3NlcmlhbCUyMiUzQSUyMiUyMiUyQyUyMmNlcnRfaXNzdWVyX3NraSUyMiUzQSUyMiUyMiUyQyUyMmNlcnRfcHJlc2VudGVkJTIyJTNBZmFsc2UlMkMlMjJjb21tb25fbmFtZSUyMiUzQSUyMiUyMiUyQyUyMmF1dGhfc3RhdHVzJTIyJTNBJTIyTk9ORSUyMiU3RCUyQyUyMmFwcFNlc3Npb25IYXNoJTIyJTNBJTIyZjA5MjU1NzYyNDAwMjI2OGJhNzU3OTNmYmE2MmQwMTc5OTBlNGEwNjdhYmY4ZmJhMWM2YWNjMTk3MzhhMjcyMyUyMiUyQyUyMmF0dGVtcHRJZCUyMiUzQSUyMmNlMTU4MTk3LTJmMjYtNDFkMC1iODdhLWIxMGQ0MGI0ZjA4MCUyMiUyQyUyMmF0dGVtcHRSZXByb21wdCUyMiUzQWZhbHNlJTdE&scope=email+profile+openid\" accesskey=\"1\" id=\"idp1\">\n <div class=\"Button-auth-service-icon\"><svg viewBox=\"0 0 256 262\"><path d=\"M13.925 71.947C5.077 89.644 0 109.517 0 130.55s5.077 40.905 13.925 58.602C35.393 231.798 79.49 261.1 130.55 261.1c35.248 0 64.839-11.605 86.453-31.622 24.659-22.774 38.875-56.282 38.875-96.027 0-10.734-.871-18.567-2.756-26.69H130.55v48.448h71.947c-1.45 12.04-9.283 30.172-26.69 42.356-11.024 7.688-25.82 13.055-45.257 13.055-34.523 0-63.824-22.773-74.269-54.25-2.756-8.123-4.351-16.827-4.351-25.82 0-8.994 1.595-17.697 4.206-25.82 10.59-31.477 39.891-54.251 74.414-54.251 24.514 0 41.05 10.589 50.479 19.438l36.844-35.974C195.245 12.91 165.798 0 130.55 0 79.49 0 35.393 29.301 13.925 71.947z\"></path></svg></div>\n <div class=\"AuthBoxRow--name\">Google ・ CyStack</div>\n </a>\n </div>\n </div>\n </div>\n <div class=\"kumo-divider\" role=\"separator\" aria-orientation=\"horizontal\">\n <span class=\"kumo-divider__label\">or</span>\n </div>\n <div class=\"AuthBox-RequestCode AuthBox-RequestCode__idpsExist\">\n <form class=\"AuthFormLogin\" action='https://cystack.cloudflareaccess.com/cdn-cgi/access/verify-code/blog.cystack.org?kid=d08cc312d3580268df3aca24cb4f4b746aa558ed0a384cb4d73dd768eb0201f7&meta=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImI5MmYyNDE3OGM5ZDZlYmRhZGYyMzA3OGIyMDRkZjRjZjgwYjUzMzdkYzQzNDkwNzliZmNmMDEzYjljZjNhYWYifQ.eyJ0eXBlIjoibWV0YSIsImF1ZCI6ImQwOGNjMzEyZDM1ODAyNjhkZjNhY2EyNGNiNGY0Yjc0NmFhNTU4ZWQwYTM4NGNiNGQ3M2RkNzY4ZWIwMjAxZjciLCJob3N0bmFtZSI6ImJsb2cuY3lzdGFjay5vcmciLCJyZWRpcmVjdF91cmwiOiIvbGFicy93cC1qc29uL3dwL3JhbmttYXRoL3YxL2dldEhlYWQ_dXJsPWh0dHBzOiUyRiUyRmJsb2cuY3lzdGFjay5vcmclMkZsYWJzJTJGMjAyNiUyRjEwJTJGMjIlMkZwaHAyc2hlbGwtdnVsbmVyYWJpbGl0eSUyRiIsInNlcnZpY2VfdG9rZW5fc3RhdHVzIjpmYWxzZSwiaXNfd2FycCI6ZmFsc2UsImlzX2dhdGV3YXkiOmZhbHNlLCJleHAiOjE3OTI3NjAzOTAsIm5iZiI6MTc5Mjc2MDA5MCwiaWF0IjoxNzkyNzYwMDkwLCJhdXRoX3N0YXR1cyI6Ik5PTkUiLCJtdGxzX2F1dGgiOnsiY2VydF9pc3N1ZXJfZG4iOiIiLCJjZXJ0X3NlcmlhbCI6IiIsImNlcnRfaXNzdWVyX3NraSI6IiIsImNlcnRfcHJlc2VudGVkIjpmYWxzZSwiY29tbW9uX25hbWUiOiIiLCJhdXRoX3N0YXR1cyI6Ik5PTkUifSwicmVhbF9jb3VudHJ5IjoiU0ciLCJhcHBfc2Vzc2lvbl9oYXNoIjoiZjA5MjU1NzYyNDAwMjI2OGJhNzU3OTNmYmE2MmQwMTc5OTBlNGEwNjdhYmY4ZmJhMWM2YWNjMTk3MzhhMjcyMyJ9.iZrqBg-LlAaglVuXfUeoGQ8XXJMirUnYZfpFyIPLozDZ18XdSRqgxBYOU4uAkgffVYOeS5J093GSHknJu5E3OjMJo91c9o4v5cVEr_BpbJo1Kc9ZPuzvNBzWdfG5TMrruLU4xwNo2RYQsyKdEUdXplguPNfQPfZugGQcEKhpjs585snPLEY1mFonVZ6EknU5_zFTfNVd_ntqlWA9hE0vqrIhSJQGqgWk2oXE30puvOGaIj4KcGlfVJYGAFZzjVux2_-aQs9V-D7unAaoe8oF84UozFRcGEzXx8gtNKRqbvSZVM8ms6OGjBJMg1tbg3F4nuSRcZ5XgFZD-WLR3vPQ7w&redirect_url=%2Flabs%2Fwp-json%2Fwp%2Frankmath%2Fv1%2FgetHead%3Furl%3Dhttps%3A%252F%252Fblog.cystack.org%252Flabs%252F2026%252F10%252F22%252Fphp2shell-vulnerability%252F' method=\"post\" id=\"totp-form\">\n <div class=\"AuthFormLogin-row\">\n <label for=\"email\">Email</label>\n <input id=\"email\" data-testid=\"email-input\" class=\"StandardInput-is-block StandardInput EmailInput\" type=\"email\" required\n placeholder=\"example@email.com\" spellcheck=\"false\" autocomplete=\"off\" autocapitalize=\"none\"\n name=\"email\">\n <input hidden type=\"text\" name=\"client_id\" value=''>\n <input hidden type=\"text\" name=\"connector_id\" value=''>\n <input hidden type=\"text\" name=\"connector_type\" value=''>\n <input hidden type=\"text\" name=\"redirect_url\" value=''>\n \n \n \n </div>\n <div class=\"AuthFormLogin-row\">\n <button type=\"submit\" form=\"totp-form\" data-testid=\"email-submit-button\" class=\"Button-is-block Button Button-is-primary\">\n Send login code\n </button>\n </div>\n </form>\n </div>\n\n </div>\n </div>\n \n </div>\n </div>\n </div>\n\n <script>\"use strict\";if(document.addEventListener(\"keyup\",function(e){if(\"BODY\"===e.target.nodeName&&e.key>=1&&e.key<=10){var t=document.getElementById(\"idp\"+e.key);window.location=t.getAttribute(\"href\")}},!1),\"\"!==fragment&&fragment.length<100){var services=get(\".js-idp\")||[];services.map(function(e){return e.href=addFragmentToURLState(e.href),e})}</script>\n \n \n </body>\n\n</html>\n"

Đọc bản tiếng Việt tại đây / Read the Vietnamese version

TL;DR

What makes this worrying is that PHP sits behind most of the web applications in the world, so the exposed surface is very wide.

If you run web applications on PHP, do the following now:

Update PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (or the matching fix from your distribution), then restart every worker (php-fpm, httpd/mod_php). Old workers keep running the vulnerable code until they are restarted.
If you cannot patch right away, apply the temporary measures below and treat them as a stopgap, not a fix.
Review logs and look for signs of exploitation going back to at least October 17, 2026, because attack attempts were recorded before the public disclosure.

Why is a bug in PHP so serious?

PHP runs about 69% of public websites worldwide

The name php2shell was coined by the research teams that found the bugs (Calif and Wiz). PHP itself does not use it.

CVE-2026-109618: memory corruption when RAM runs out

CVE-2026-109619: reusing old state that was already freed

INI configuration diagnostics that run before request initialization. For example, warnings about deprecated options, raised through mod_php’s .htaccess or FPM’s environment variables. Turning off error display (display_errors, error_reporting, the @ operator) does not help here.
Backtraces on fatal errors in PHP 8.5 (the fatal_error_backtraces option, new in 8.5.0 and on by default). This is the strongest case demonstrated, and the basis of the confirmed RCE exploit on mod_php.
Session upload progress tracking (session.upload_progress). It is on by default and does not need the application to call session_start(), which means your website is affected even if it never uses the feature.

Why this is hard to stop

How severe are the two vulnerabilities?

You will see php2shell scored differently depending on the source:

The PHP team (acting as CNA) scores both at CVSS v4.0 9.2 (Critical), noting high attack complexity.
NVD scores CVSS v3.1 9.8 (Critical).
Some distributors, such as Red Hat, SUSE and Amazon Linux, score 8.1 on CVSS v3.1 and rate it Important, because reliable exploitation needs heap manipulation and precise timing.
Ubuntu labels it Critical.

Timeline

2024: A PHP core developer noticed the first sign of the OOM bug while handling a report from an audit run by Quarkslab and OSTIF. No concrete exploitation vector was found at the time, and the fix was delayed for months.
August 11, 2026: The Calif team reported RCE with this same root cause. OpenAI independently reported the same cause on the same day.
August 24, 2026: Wiz reported additional attack vectors.
October 17, 2026: AWS’s MadPot honeypot system recorded an attempt to exploit php2shell, four days before disclosure.
October 20, 2026: The CVE IDs leaked publicly (with a wrong score of 10.0 and a wrong release time). The PHP team issued an early notice and moved the release up by one day.
October 21, 2026: PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 released, around 14:00 UTC (about 21:00 in Vietnam).

Real-world exploitation

Recommendations for organizations

1. Patch now, and restart your workers

2. If you cannot patch yet: temporary measures

PHP states clearly that the measures below only reduce the attack surface on some paths and do not make a system completely safe:

For CVE-2026-109618 (OOM): set memory_limit = -1 at the admin level (php_admin_value) so applications cannot override it, combined with request size limits at the proxy or web server in front, and the cgroup memory limit so that only a single worker is taken down when needed. Warning: do not use RLIMIT_AS / RLIMIT_DATA to enforce limits, because they make memory allocation fail and trigger the very same bug path. With memory_limit = -1, a single request can eat all the server’s RAM, so monitor memory closely and restore the limit right after patching.
For CVE-2026-109619 (stale state): set session.upload_progress.enabled = 0, and on PHP 8.5 also fatal_error_backtraces = 0. Set them in php.ini, a drop-in file in conf.d, or the FPM pool (php_admin_flag), not through ini_set() or .user.ini, which take effect too late. Restart every worker after changing them. This only blocks the confirmed paths, not every variant.
Block multipart at the edge: if the application does not use multipart/form-data uploads, block that request type at the web server before it reaches PHP. Note that this breaks file upload features (for example product image uploads on Magento) and some payment forms.
Last resort: if you cannot do anything in time, consider taking public-facing PHP systems offline, or allowing only GET/HEAD methods until you patch. CISA, the UK NCSC and CERT-EU all recommend this for the worst case, especially for mod_php and PHP 8.1 and earlier.

3. Hunt for signs of exploitation

A successful exploit may leave few traces (an HTTP 200 response, no worker crash, no application log), so seeing no errors does not mean you are safe. Some signs worth checking:

In PHP logs: the error line PHP Fatal error: Allowed memory size of N bytes exhausted ... in Unknown on line 0. The phrase “Unknown on line 0” shows the error happened during request initialization, before any script ran. Cross-check it against unusual POST requests, worker crashes, or Apache reporting “AH00052 … Segmentation fault”.
Post-exploitation signs (the most important): a PHP or web process (php-fpm, php-cgi, httpd, apache2) spawning a shell (sh, bash), especially with an outbound connection, or calling curl, wget or nc. Reconnaissance commands such as whoami, id and uname running as the web server user often follow. CISA also confirms that “a PHP process launching a shell or downloading tools” is a signal to watch.
Because leaked worker memory may contain passwords, tokens and API keys, rotate these secrets after patching if you suspect exposure.
Review window: start from at least October 17, 2026, because attack attempts were recorded before the public disclosure.

4. Inventory every place PHP runs

Contact CyStack for support

References

PHP advisory: php.net/archive/2026
GHSA-w8hw-w9fx-j79w (CVE-2026-109618): github.com/php/php-src
GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): github.com/php/php-src
PHP Foundation post on the incident and release process: thephp.foundation
NVD CVE-2026-109618: nvd.nist.gov
NVD CVE-2026-109619: nvd.nist.gov
Calif analysis: calif.io/php2shell
Wiz analysis: wiz.io
Datadog Security Labs analysis: securitylabs.datadoghq.com
CISA alert: cisa.gov
CERT-EU advisory: cert.europa.eu

Our Research

Our Research

PHP2Shell: a critical PHP flaw that reaches 70% of the web

TL;DR

Why is a bug in PHP so serious?

CVE-2026-109618: memory corruption when RAM runs out

CVE-2026-109619: reusing old state that was already freed

Why this is hard to stop

How severe are the two vulnerabilities?

Timeline

Real-world exploitation

Recommendations for organizations

1. Patch now, and restart your workers

2. If you cannot patch yet: temporary measures

3. Hunt for signs of exploitation

4. Inventory every place PHP runs

Contact CyStack for support

References

About the author

Related posts

TL;DR

Why is a bug in PHP so serious?

CVE-2026-109618: memory corruption when RAM runs out

CVE-2026-109619: reusing old state that was already freed

Why this is hard to stop

How severe are the two vulnerabilities?

Timeline

Real-world exploitation

Recommendations for organizations

1. Patch now, and restart your workers

2. If you cannot patch yet: temporary measures

3. Hunt for signs of exploitation

4. Inventory every place PHP runs

Contact CyStack for support

References