PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server.

The flaws, together called PHP2Shell, sit in the PHP runtime, not in any application, so a site is exposed even when its own



Source: TheHackerNews
Source Link: https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html