Most critical vulnerabilities follow a script: researchers report privately, vendors patch, and the world finds out on disclosure day. PHP2Shell broke the script at every step. Details leaked early, attackers started probing before a patch existed, and within a week CISA was warning that the bugs were being chained with a Linux kernel exploit to get root.

PHP still runs a large share of the web, and that's why this one matters.

What happened

On 21 October 2026 , the PHP project shipped emergency security releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 . They fix two critical vulnerabilities in PHP itself that can allow unauthenticated remote code execution . Both are rated 9.2 under CVSS v4.0 by PHP's security team.…