InfoQ

PHP Patches Two Critical RCE Flaws That Were Already Under Attack

PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities allowing unauthenticated remote code ...

PatchMyPHP launches a free PHP vulnerability checker that shows website owners in under a minute whether the October 2026 PHP flaw (CVE-2026-109618) leaves them exposed

A free PHP vulnerability checker from PatchMyPHP lets any website owner find out in less than a minute whether the ...
LWN.net

PHP patches released for two critical RCEs

The PHP project has published PHP versions 8.5.12 , 8.4.27, 8.3.36 and 8.2.35 to address two critical vulnerabilities that could allow unauthenticated remote code execution.
Help Net Security

A critical PHP security release is coming today, so get ready to update!

The PHP security team has announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC. The release fixes ...
Notebookcheck

PHP2Shell leaves millions of servers on PHP versions with no official fix

PHP2Shell fixes skip older branches. See how many servers run PHP versions with no official patch, which backports exist, and what admins need to do about it soon.
Notebookcheck

PHP2Shell: Critical PHP flaws hit mod_php servers hardest

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that allow unauthenticated code execution, in some setups before any application code runs. Here is what goes wrong in the interpreter, ...

What is PHP2Shell? A guide for site operators on the critical vulnerability in PHP itself

"PHP2Shell" is becoming a hot topic, even trending on note. Simply put, it is a story about a hole found in the PHP that ...

How I, with no server knowledge, used an AI agent to upgrade from PHP 8.1 to 8.4 in 3 days after seeing the PHP2Shell news

Have you all responded to the PHP2Shell news yet?It is news that a critical vulnerability was found in the PHP core, and an ...