PHP team releases October 21 security patches for PHP2Shell flaws

Top News · 439 HN points

PHP2Shell is a set of critical memory-safety vulnerabilities in PHP's core engine, not a flaw limited to a particular CMS. The PHP team released patches on October 21, 2026, to address the underlying issue.

Here's what to act on:

• Apply the PHP security update for your deployed version. Wiz's report says the fix eliminates variants in patched releases.
• The reported issues affect PHP versions dating back to 5.4 and span two CVEs, with severity reaching CVSS 9.2. Successful exploitation could enable remote code execution or disclose process memory.
• Wiz's report credits Gemini 4 Argon with contributing to discovery, exploit development, detection, and patch validation. The research also used Wiz Atlas and GPT-5.6 Sol.
• Wiz customers can consult the PHP2Shell advisory in the Threat Intel Center for detection and remediation guidance. Sensor customers need version 1.0.12768 for the described response policy.

One catch: The research findings may not transfer unchanged across PHP versions, configurations, and application behavior.

Sources: wiz.io