php2shell patches (CVE-2026-109618 and CVE-2026-109619) for EOL PHP are out now. With sales replies slower than usual due to high demand, the fastest route to patched packages is to buy ELS for Runtimes online (opens in new tab). Read the patch FAQ

Why the Mastra easy-day-js Attack...

The Short Version What: On June 17, 2026, an attacker used a hijacked maintainer account to republish 140+ packages across the @mastra npm scope, the AI-agent framework from the team...