https://reddit.com/r/sysadmin/comments/1xcf6ue/two_critical_php_rce_flaws_tracked_as_php2shell/: Two critical PHP RCE flaws, tracked as PHP2Shell, leaked ahead of coordinated disclosure.
Published Oct 22, 2026
·Updated
Affected Software
1 affected component
PHP PHP>=8.2<=8.5
Frequently Asked Questions
1
Which PHP deployments are expected to receive fixes?
Fixes are coming for supported PHP branches 8.2 through 8.5. End-of-life PHP versions will not receive patches.
2
What should teams running an end-of-life PHP version do?
They cannot rely on a patch for these vulnerabilities because end-of-life versions will not receive fixes. Upgrade or migrate to a supported PHP branch.
3
When was the security release scheduled?
The PHP security release was scheduled for October 21 at 14:00 UTC.