Overview
- Two critical vulnerabilities dubbed PHP2Shell permit unauthenticated remote code execution inside the PHP runtime, allowing attackers to run commands before any site code executes.
- The PHP team published emergency fixes for supported branches on October 21, 2026, and vendors issued backports where possible.
- Security telemetry from multiple providers recorded millions of automated probe and exploit attempts within hours of details leaking, but the PHP Foundation says it has found no confirmed widespread successful takeovers so far.
- Operators are urged to inventory internet-facing PHP installations, apply the October 21 updates or mitigations, and review logs for signs of compromise dating back at least to the days before the public disclosure.
- The incident highlights how advanced AI tools can shorten the time from discovery to practical exploit, increasing pressure on maintainers and leaving long-lived legacy and embedded PHP builds as a persistent attack surface.