Isophoric News · Thursday, October 22, 2026
PHP releases emergency patches for two critical flaws that let attackers run code on web servers
The PHP project released emergency security patches Wednesday for two critical flaws, together called PHP2Shell, that let an attacker with no account run code on a web server, The Hacker News and BleepingComputer reported. Both are rated 9.2 on the CVSS v4.0 scale and affect all PHP installations that serve web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk on mod_php, according to The Hacker News and InfoWorld. The PHP team says only updating fully protects a server, and recommends PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; the flaws were found by researchers at Wiz, Calif and OpenAI, The Hacker News reported. Cloudflare's chief technology officer, Dane Knecht, said the company was seeing early attacks emerge, while watchTowr reported no exploitation in the wild as of 11:26 UTC on Oct. 21, according to The Hacker News. InfoWorld reported that some government websites in Europe, including in the Netherlands and Finland, went offline as a precaution.