Two Critical PHP Vulnerabilities Exposed

Two critical PHP vulnerabilities were disclosed publicly on October 21, 2026, affecting versions from 5.4 through 8.5.11. The flaws, named php2shell, allow remote code execution and system compromise. Thousands of exploitation attempts jumped to millions within two hours of the announcement. The US National Security Agency advised organizations to take systems offline immediately if updates are not feasible.