PHP maintainers confirmed they will release two emergency patches for vulnerabilities rated 9.2 out of 10 in severity. The patches are scheduled to drop within 12 hours of...
PHP maintainers announced plans to release two emergency patches for critical vulnerabilities.
What Changed
PHP maintainers confirmed they will release two emergency patches for vulnerabilities rated 9.2 out of 10 in severity. The patches are scheduled to drop within 12 hours of October 21, 2026. An unconfirmed report suggests the vulnerabilities could be exploited via a tool dubbed PHP2Shell, allowing remote code execution on PHP-powered websites.
What Is Confirmed
PHP maintainers stated they are preparing to release patches for two vulnerabilities, both rated 9.2 on the CVSS scale. The advisory warns website administrators to prepare for the update, which will be available shortly after October 21, 2026. The patches are intended to address flaws believed to be exceptionally severe. The advisory also notes the possibility of an earlier release if details of the vulnerabilities become public or if evidence of active exploitation emerges.
The sources indicate the maintainers published an advisory following the leaking of purported exploit details, though these have not been independently verified. The advisory does not confirm the existence of the PHP2Shell exploit but acknowledges the potential risk.
What to Watch or Do Next
Website administrators and developers should monitor official PHP channels for the patch release. If the PHP2Shell exploit is validated, affected systems must be updated immediately to mitigate risk. The advisory recommends preparing for the update by ensuring servers and applications are configured to receive the patches promptly.
Frequently Asked Questions
Q1: What are the severity ratings of the vulnerabilities?
The vulnerabilities are rated 9.2 out of 10 on the CVSS scale, indicating they are exceptionally severe.
Q2: Is the PHP2Shell exploit confirmed?
The PHP2Shell exploit remains unconfirmed, though sources suggest it could be linked to the vulnerabilities.
Q3: When will the patches be available?
The patches are scheduled to drop within 12 hours of October 21, 2026, though an earlier release is possible if exploitation evidence surfaces.