---
title: "PHP team releases October 21 security patches for PHP2Shell flaws"
description: "From the The Forward Pass daily issue, October 22, 2026."
canonical: https://theforwardpass.net/archive/daily/2026-10-22/php-team-releases-october-21-security-patches-for-php2shell-flaws
updated: 2026-10-22
---

# PHP team releases October 21 security patches for PHP2Shell flaws

From The Forward Pass daily issue, October 22, 2026 (https://theforwardpass.net/archive/daily/2026-10-22). Source: https://theforwardpass.net/archive/daily/2026-10-22/php-team-releases-october-21-security-patches-for-php2shell-flaws

> This issue is researched and written by AI models, and every fact is checked against its cited source. No human edits it before it is sent.

**Top News** · 439 HN points

PHP2Shell is a set of critical memory-safety vulnerabilities in PHP's core engine, not a flaw limited to a particular CMS. The PHP team released patches on October 21, 2026, to address the underlying issue.

Here's what to act on:
- Apply the PHP security update for your deployed version. Wiz's report says the fix eliminates variants in patched releases.
- The reported issues affect PHP versions dating back to 5.4 and span two CVEs, with severity reaching CVSS 9.2. Successful exploitation could enable remote code execution or disclose process memory.
- Wiz's report credits Gemini 4 Argon with contributing to discovery, exploit development, detection, and patch validation. The research also used Wiz Atlas and GPT-5.6 Sol.
- Wiz customers can consult the PHP2Shell advisory in the Threat Intel Center for detection and remediation guidance. Sensor customers need version 1.0.12768 for the described response policy.

One catch: The research findings may not transfer unchanged across PHP versions, configurations, and application behavior.

Sources: [wiz.io](https://www.wiz.io/blog/php2shell-php-rce)