PHP Patched the Two Critical RCE Flaws: Versions, Risk by SAPI, and Stopgaps

On October 21, 2026, the PHP team released emergency security updates to address two critical unauthenticated remote code execution vulnerabilities known as PHP2Shell. These flaws reside within the PHP runtime, allowing attackers to execute code on web servers without authentication. To ensure full protection, users must immediately update to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. While some configuration changes may reduce exposure, the PHP team emphasizes that updating is the only way to fully secure servers.