PHP2Shell Critical Flaws Patched; Single Workaround Insufficient Without Full Update

The PHP development team has released a patch at 14:00 UTC on October 21, 2026, to address two critical vulnerabilities rated 9.2 out of 10 in severity. The flaws, identified under the name PHP2Shell, affect PHP installations globally and carry the potential for remote code execution.

According to coverage from The Hacker News, a security firm had previously circulated a specific setting as a workaround. However, the firm now states that this setting does not provide sufficient protection on its own. PHP itself has not issued an official workaround, and the publication notes that the setting being discussed cannot fully block exploitation before the patch is applied.

The vulnerabilities were made public ahead of the patch release, and active discussion regarding exploitation risk has been ongoing. Security researchers and threat actors alike are believed to be targeting unpatched PHP installations. The Hacker News report emphasizes that relying on the workaround setting alone leaves systems vulnerable; the only effective remediation is applying the official PHP patch.

Organizations are advised to prioritize updating PHP to the latest stable version as soon as possible. In the absence of a complete workaround, additional layers such as web application firewalls, input validation, and restricted file permissions are recommended as temporary measures, but should not be considered sufficient on their own.