PHP2Shell: Two Critical Remote Code Execution Flaws Rated CVSS 9.2 Trigger Emergency Security Release

The PHP security team has announced an out-of-cycle security release scheduled for 14:00 UTC on October 21, 2026, to address two critical remote code execution vulnerabilities. According to watchTowr researchers, the two flaws are rated 9.2 on the CVSS v4.0 scale and affect the four supported PHP branches: 8.2, 8.3, 8.4, and 8.5. The security advisory notes that no exploitation has been reported publicly so far. The Hacker News reported that the PHP security team has not yet described the technical details of the vulnerabilities, and the advisory is pending official release. The widespread use of PHP in web hosting and content management systems means the potential impact is significant, though the full vector specifics remain under embargo until the patch is deployed.