<![CDATA[🔴 Critical: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge]]>PHP has pushed out emergency updates addressing two critical vulnerabilities in the PHP language itself that could allow an unauthenticated attacker to execute code on a web server. The fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and according to the PHP team, only applying the update provides full protection for a server.

The two flaws, collectively tracked as PHP2Shell, reside in the PHP runtime rather than in any application layer. This means a site can be exposed even when its own code is not at fault, since the weakness exists beneath whatever application is running on top of the interpreter.

Key points for defenders:

  • The vulnerabilities are unauthenticated, requiring no account or credentials to exploit.
  • Because the flaws sit in the runtime, patching the application code or hardening the site will not remediate them.
  • The affected update branches are 8.5.x, 8.4.x, 8.3.x, and 8.2.x, with fixes landing in the point releases listed above.
  • The PHP team's guidance is clear: updating is the only complete protection.

If your organization runs PHP in any capacity, treat this as urgent and verify which version your servers and containers are running before the weekend.

Source: info@thehackernews.com (The Hacker News)

Has your team already confirmed which PHP versions are running across your environments, or are you still mapping affected hosts?

]]>https://xploitlk.com/topic/797/critical-php-issues-emergency-patches-for-two-critical-php2shell-rce-flaws-as-exploit-attempts-emergeRSS for NodeTue, 27 Oct 2026 07:22:49 GMTMon, 26 Oct 2026 06:30:18 GMT60