> TritonInfoSec News
Home / Oct 21, 2026 / Story
0
#1 The Hacker News general October 21, 2026 at 04:57 UTC

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

By [email protected] (The Hacker News)

AI Summary

PHP's security team disclosed two critical vulnerabilities rated CVSS 9.2 (v4.0) affecting all supported branches (8.2–8.5), with watchTowr researchers confirming both flaws enable remote code execution. An emergency out-of-cycle patch was scheduled for release at 14:00 UTC on October 21, triggered after details reportedly leaked ahead of scheduled disclosure. No exploitation has been reported yet, but the PHP2Shell designation and public researcher attention make rapid patching urgent for any PHP-based infrastructure.

Read full article → https://thehackernews.com/2026/10/php2shell-two-un…

Relevance score: 92.0/100

# More from October 21

  1. 2
    Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader The Hacker News
  2. 3
    Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software The Hacker News
  3. 4
    Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA The Hacker News
  4. 5
    Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution The Hacker News
  5. 6
    AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign SecurityWeek
  6. 7
    Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death Graham Cluley
  7. 8
    Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware The Hacker News
  8. 9
    Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election The Hacker News
  9. 10
    ConnectWise customers hit by supply-chain attack linked to compromised API secret CyberScoop