PHP Foundation issues urgent patches for decade old remote code execution flaws

The PHP Foundation released security updates on Wednesday to address two critical flaws in its server-side code, BankInfoSecurity reported. The vulnerabilities allow unauthenticated attackers to remotely execute arbitrary code, steal data, and gain full control over underlying servers. Maintainers are urging all users to update their systems immediately. [1]

The security flaws are known as PHP2Shell and affect memory safety in PHP versions 5.4 through 8.5, according to Wikipedia. The vulnerabilities were publicly announced on October 20, 2026. The PHP Foundation subsequently released security patches for versions 8.5.12 and 8.4.27, alongside updates for versions 8.2 and 8.3, BankInfoSecurity and Wikipedia reported. [1][4]

The underlying security issues have existed in the code base for more than ten years, BankInfoSecurity reported. Core PHP software powers an estimated 70 percent of websites worldwide, according to SSBCrack. Security experts warn that the flaws present a severe risk to organizations using the vulnerable software. [1][3]

Numerous administrators temporarily took websites offline to apply emergency patches before malicious users could deploy exploits, according to Wikipedia. Systems administrators and IT operators are advised to apply the official updates across all vulnerable server environments immediately. [1][4]