Science & Technology21 Oct 2026 · about 7 min

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

The brief

Remote code execution, or RCE, means specially crafted input can cause a vulnerable server to run an attacker’s commands. That is especially serious for PHP because PHP commonly processes web requests on internet-facing systems. An attacker may not need an account or local access if the vulnerable path is reachable remotely. Researchers at watchTowr say the two undisclosed flaws allow RCE. PHP’s security team rated them 9.2 on the CVSS v4.0 scale. The earlier leaked post gave a different 10.0 score, but PHP’s official rating is 9.2. The article does not describe the flaws’ technical mechanism or confirm their configuration requirements. No exploitation had been reported as of October 21, and no public proof of concept was known. Still, RCE can turn a web-facing PHP service into a launch point for further activity. PHP is releasing fixes out of cycle because vulnerability details might become public, or active exploitation might begin.

What is remote code execution, and why do the two PHP2Shell vulnerabilities receive a critical-risk rating?

Researchers at watchTowr say the two undisclosed flaws allow RCE. PHP’s security team rated them 9.2 on the CVSS v4.0 scale. The earlier leaked post gave a different 10.0 score, but PHP’s official rating is 9.2. The article does not describe the flaws’ technical mechanism or confirm their configuration requirements.

No exploitation had been reported as of October 21, and no public proof of concept was known. Still, RCE can turn a web-facing PHP service into a launch point for further activity. PHP is releasing fixes out of cycle because vulnerability details might become public, or active exploitation might begin.

What did PHP announce, and why is it issuing an emergency, out-of-cycle security release?

PHP announced an out-of-cycle security release for two critical vulnerabilities. The release was scheduled for 14:00 UTC on October 21. PHP’s security team rated both flaws 9.2 on CVSS v4.0, while watchTowr researchers said they allow remote code execution. PHP had not yet published technical details, affected versions, or fixed versions before release.

The emergency timing followed a leak on October 20. A post on HN claimed two PHP RCE flaws would be disclosed on October 22 and listed two CVE identifiers. watchTowr confirmed that the information was real and said the flaws were under embargo. PHP then published its own notice at 19:33 UTC and moved the release to Wednesday, one day earlier.

PHP said it might release early if vulnerability details became public or evidence of active exploitation appeared. The leak exposed the flaws’ existence, a score, a date, and identifiers, but not how they worked. As of October 21, exploitation remained unreported.

Which PHP branches may be affected, and which versions are expected to receive fixes?

The four supported PHP branches are 8.2, 8.3, 8.4, and 8.5. They are the branches eligible to receive PHP’s official fixes. PHP says the release will publish the affected and fixed versions, so the full vulnerability range was not confirmed before publication. Claims that every version since PHP 5 is affected remained unverified.

Trackers and researcher Kevin Beaumont expected the fixes to arrive in the next point releases: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Those numbers were not confirmed by PHP ahead of the release. PHP records branch changes in its changelogs. Versions 8.2 and 8.3 receive security fixes, while 8.4 and 8.5 are actively supported.

Older versions, including 8.1, 8.0, 7.x, and 5.x, are end of life. PHP provides no vendor fix for them. If those branches are affected, their operators must upgrade, isolate systems, or use temporary protection while planning a supported migration.

How many internet-facing systems were reporting an end-of-life PHP version, and what does that number tell us about the potential exposure?

Mallory counted about 884,000 internet-facing hosts whose HTTP banners reported PHP 8.1 or older on October 20. Those hosts represented 59% of the roughly 1.5 million hosts that reported any PHP version to Shodan. Because PHP 8.1 and older are end of life, these systems would not receive a direct PHP fix if the flaws affect them.

The number measures banners, not confirmed vulnerabilities. A banner can be inaccurate, incomplete, or unrelated to the specific configuration required by a flaw. The article also notes that about 740,000 hosts reported PHP without a version. Those systems add uncertainty because their branch and patch status could not be determined from the count.

The figures show why rapid inventory and prioritization matter. Organizations should identify PHP in servers, appliances, Windows software, and control panels. Internet-facing systems should be patched first when fixes arrive. Until then, older installations may need isolation, VPN access, or a web application firewall.

What could an attacker do if these flaws allow remote code execution on a PHP server?

If the flaws genuinely permit remote code execution, an attacker could make the PHP server execute commands through a web request. The article does not confirm the exact commands or attack chain. However, it recommends watching whether PHP processes start shells, interpreters, or download tools. That guidance reflects the danger of code execution beyond normal request handling.

For example, defenders should alert when php-fpm, php-cgi, httpd, or apache2 launches a shell or download utility. They should also inspect for web shells, new files in the web root, new cron jobs, scheduled tasks, and accounts. Florian Roth’s process-watcher can record programs started by PHP and their command lines, but it prevents nothing.

The practical response is immediate containment if suspicious activity appears. Isolate the server, preserve web-server and PHP logs, and investigate. No exploitation had been reported as of October 21, but the impact could grow quickly if details or exploit code become public.

What alternatives are available to organizations that cannot patch immediately, such as upgrading, isolating systems, using a VPN, or deploying a web application firewall?

The safest option is to upgrade to a supported, fixed PHP branch as soon as the release lands. Teams should inventory every installation first, including PHP inside appliances, Windows software, and control panels. Internet-facing systems deserve priority. Linux distributions and hosting providers may supply backported packages, so operators should check them rather than assume only upstream packages count.

If immediate patching is impossible, an organization can take the system off the internet or restrict access behind a VPN. CERT-EU also advises considering isolation of internet-facing applications from public networks until a fix is available. A web application firewall can provide another defensive layer. These measures reduce exposure, but they are temporary safeguards, not replacements for upgrading.

End-of-life branches create extra risk because PHP will not patch them. Operators should plan migration while applying containment. They should also monitor PHP-launched processes and investigate suspicious files, scheduled tasks, accounts, or web shells. No PHP workaround had been published before the release.

How does PHP handle a web request, and how can a flaw in that process allow specially crafted input to start programs or shells on the server?

PHP receives web requests through server components such as php-fpm or php-cgi, often alongside web servers identified in the article as httpd or apache2. The PHP process reads request data, runs application logic, and returns a response. The article does not provide the vulnerable code path or explain the exact mechanism behind these two flaws.

In general, a flaw in request processing can make specially crafted input behave like instructions instead of ordinary data. If that happens, the PHP process may start another program. The article’s defensive advice names shells, interpreters, and download tools as suspicious children of php-fpm, php-cgi, httpd, or apache2. Roth’s process-watcher records such launches after they occur.

That possibility matters because the request begins remotely, while the resulting program runs on the server. The exact requirements remain unknown: PHP has published no workaround, and no configuration or feature requirement has been described. The release should clarify the affected versions and technical details.

This brief was written by AI from the original reporting and checked by other models. Names, figures and quotes come from the source; read it for full context.