PHP warns it plans to release 2 emergency patches imminently
arstechnica.com
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.

The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5

  • IanTwenty@piefed.socialEnglish
    4·
    14 hours ago

    They didn’t move fast enough on it and others began circulating it. So they had to play catch up, hence the need to react before they had a patch.

    We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged.

    https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

    • communism@lemmy.mlEnglish
      1·
      8 hours ago

      Wow, this article really reads as LLM-generated to me. The quoted section with the “We won’t pretend otherwise:”, the second paragraph in:

      This post isn’t about how to update. It’s about how these vulnerabilities were found and fixed, what has changed in how PHP security is handled over the past two years, and what we need from the organizations that depend on PHP to keep PHP’s security work going.

      Could they not be bothered to write a write-up about such a critical severity?