PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
PHP releases emergency patch for two critical RCE flaws (CVSS 9.2) in branches 8.2–8.5.
PHP announced an out-of-cycle security release on October 21 to address two critical remote code execution vulnerabilities rated 9.2 on the CVSS v4.0 scale. Discovered by watchTowr security researchers, the flaws affect supported PHP branches 8.2 through 8.5, with no active exploitation reported. Details remain undisclosed pending the patch deployment.
AI summary of the linked source. Not reviewed by an editor. How this works
Run PHP Group?
Get an email when a new story names PHP Group, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTwo critical remote code execution vulnerabilities (CVSS 9.2) in PHP 8.2–8.5 forced an out-of-cycle emergency release, highlighting the ever-present risk of unpatched runtime environments. PHP powers a vast portion of the web, meaning delayed patching exposes millions of applications to potential full server compromise. The severity of these flaws underscores why organisations must have emergency patch procedures that operate outside normal maintenance windows. Even with no active exploitation reported at disclosure, the window between public announcement and weaponisation is historically very short, making rapid response non-negotiable.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.