php2shell, Two Critical PHP Bugs Leaked Before the Patch

Wed, 21 Oct 2026 12:13:26 +0400

PHP ships an emergency security release today, October 21, 2026, at 14:00 UTC. The release fixes two critical bugs in PHP core. People already call them “php2shell”. The details leaked one day before the embargo ended, so the clock started early for everybody who runs PHP.

This post shows what is public at 08:00 UTC on October 21. I will add an update when the release is out.

Update (October 21): The PHP Foundation warns that the volunteer-run Remi repository (rpms.remirepo.net) will not have updates today. If you install PHP from Remi, switch to your distribution’s packages or build from source, so you can apply the fix as soon as it is out.

Vulnerability Management on ABGEO's Personal website

php2shell, Two Critical PHP Bugs Leaked Before the Patch