Introduction

On October 21, 2026, the PHP project shipped emergency security releases for two critical vulnerabilities nicknamed PHP2Shell . They let an unauthenticated attacker run code on a server through an ordinary HTTP request, and they live in the PHP engine itself, so a perfectly written application can still be exposed. Because PHP powers WordPress, Magento, Drupal, countless control panels and most shared hosting, the reach is enormous.

The confusing part is the patching. Ubuntu and other distributions fix PHP without changing the version number, so a server reporting an old version such as 8.3.6 might be vulnerable or might be fully patched. Shared hosting customers and WordPress owners also can't simply "run an update".…