confirmedcriticalVulnerabilityFirst reported Oct 21, 2026 · Updated Oct 21, 2026
PHP: emergency patches for two critical PHP2Shell RCE flaws amid exploit attempts
PHP released emergency updates fixing two critical remote code execution flaws, collectively called PHP2Shell, that allow an unauthenticated attacker to run code on a web server. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws reside in the PHP runtime itself, and exploit attempts are reported to be emerging.
Members only
The full record: the timeline (3 updates) and 10 linked reports
- Every update as it happened, with the status at each step
- Every report behind the record, newest first
- Alerts the moment PHP — or anything else you track — is hit again
A free account is all it takes — no card, one minute.