PHP warns it plans to release 2 emergency patches imminently
arstechnica.com
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.

The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5

  • communism@lemmy.mlEnglish
    1·
    6 hours ago

    Wow, this article really reads as LLM-generated to me. The quoted section with the “We won’t pretend otherwise:”, the second paragraph in:

    This post isn’t about how to update. It’s about how these vulnerabilities were found and fixed, what has changed in how PHP security is handled over the past two years, and what we need from the organizations that depend on PHP to keep PHP’s security work going.

    Could they not be bothered to write a write-up about such a critical severity?