PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
Swati KhandelwalOctober 21, 2026Vulnerability/Web Security PHP will submit an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team rated 9.2 on the CVSS v4.0 scale but did not describe. Security researchers at watchTowr say the two flaws allow remote code execution. Only the four supported PHP branches, … Read more