PHP patches two critical unauthenticated remote code execution flaws
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; WordPress updates do not patch PHP itself.
90
Vendor
PHP Group
- Mentions · 7d7
- Mentions · 30d7
- All mentions7
- First seenOct 20, 2026
- Last mentioned4d ago
Timeline
7 articles · newest firstPHP patches unauthenticated RCE flaws dubbed PHP2Shell
Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; a public exploit hits before application code runs.
88
Unit 42 warns of two critical PHP RCE flaws scored 9.2
Unit 42 says it has seen proof-of-concept code and telemetry showing over 22.6 million potentially exposed instances.
78
PHP rushes emergency patches as early php2shell attacks reported
Cloudflare says early attacks are emerging and has pushed temporary firewall rules to all customers, including free accounts.
90
Wiz details PHP2Shell RCEs in core PHP back to 5.4
Unauthenticated attackers can run code or read worker memory that may hold passwords, tokens and keys; PHP patched on October 21, 2026.
86
PHP session upload-progress use-after-free posted before a patch
The author publishes a public framework and says stock PHP 8.2.34 and 8.4.4 can reach code execution.
68
PHP team warns of two critical flaws ahead of October 21 release
Both issues are rated CVSS v4.0 9.2, and affected and fixed versions will be published with the 14:00 UTC release.
68
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-10961812%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- PHPproduct · 7
- National Cyber Security Centreorganization · 2
- Cloudflarevendor · 2
- Drupalproduct · 2
- Joomlaproduct · 2
- WordPressproduct · 2
- Laravelproduct · 1
- Palo Alto Networksvendor · 1
- LiteSpeedproduct · 1
- PHP-FPMproduct · 1
- PHP Foundationorganization · 1
- Cortex XSIAMproduct · 1
- Unit 42organization · 1
- Wizvendor · 1
- watchTowrorganization · 1
- FrankenPHPproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.