PHP Releases Emergency Patches for Two Critical RCE Flaws Rated CVSS 9.2
PHP has released emergency patches for two critical remote code execution vulnerabilities tracked as PHP2Shell, both rated CVSS 9.2. Early exploit attempts have been observed, prompting the urgent release. The flaws affect PHP, a widely used server-side scripting language, and the high severity score indicates attackers could execute arbitrary code remotely. Multiple outlets reported the flaws remained unpatched at publication, with a security release expected October 21. A cyber agency warned websites may go dark. Administrators are urged to apply patches promptly.
IllustrationEditorial responsibility
- No named human review is recorded for this page.
- Reports are grouped by semantic similarity and deterministic rules. Language models may assist titles, summaries, translation and cross-source analysis; the page reads the event directly, while its address stays stable when the title changes.
- Summary covers the current reports
Cross-source coverage
Reporting timeline
PHP Releases Emergency Patches for Two Critical RCE Flaws Rated CVSS 9.2
PHP has issued emergency patches addressing two critical remote code execution vulnerabilities, tracked under the label PHP2Shell, both rated CVSS 9.2. According to The Hacker News, early exploit attempts have already been observed, prompting the urgent release. The flaws affect PHP, a widely used server-side scripting language, and the high severity score indicates attackers could execute arbitrary code remotely. Users and administrators are urged to apply the patches promptly to mitigate the risk of active exploitation. No further details on affected versions or specific exploitation vectors were provided in the source item.
Read sourceUnpatched Critical PHP RCE Flaws Trigger Emergency Security Alert
Multiple outlets are reporting that two unpatched critical remote code execution (RCE) vulnerabilities in PHP, rated CVSS 9.2, have triggered an emergency security alert. The Hacker News describes the flaws as "PHP2Shell," while Ars Technica reports that PHP maintainers are telling web developers to prepare for critical security patches. Chron notes that the vulnerability puts WordPress and other websites at risk following a leak, and Laravel News states a critical PHP security release is coming on October 21. Cyber Daily also reports that PHP is preparing to address the pair of critical RCE vulnerabilities. The reports indicate the flaws remain unpatched at the time of publication, with a security release expected imminently.
Read sourcePHP Maintainers Warn of Critical Security Patches Coming October 21
PHP maintainers are warning web developers and administrators to prepare for an emergency security release scheduled for October 21. Multiple reports indicate the release will address two critical vulnerabilities, with at least one outlet describing them as remote code execution (RCE) flaws. Ars Technica, BleepingComputer, Cyber Daily, Laravel News, and RuntimeWire all highlight the urgency, advising admins to be ready to apply patches promptly. The exact technical details of the vulnerabilities have not been fully disclosed in the aggregated headlines, but the coordinated warnings from the PHP project and security media suggest a high-severity threat. Developers running PHP-based websites and applications are urged to monitor official channels and update as soon as patches become available.
Show 2 older updatesHide older updates
Critical PHP Security Release Expected October 21 Amid Emergency RCE Flaw Warnings
Multiple outlets report that PHP is preparing an emergency security release expected on October 21. Laravel News says a critical PHP security release is coming tomorrow. Reuters reports a cyber agency warning that websites may go dark as PHP prepares a critical fix. The Hacker News describes two unpatched critical PHP remote code execution flaws, tracked as PHP2Shell with a CVSS score of 9.2, which triggered an emergency security alert. Ars Technica reports that PHP has warned it plans to release two emergency patches imminently. Yahoo Tech offers guidance on what to know about the critical PHP vulnerability threatening the Internet. The reports indicate the flaws are unpatched as of publication and that administrators should prepare for urgent updates.
Read sourcePHP Warns Admins of Two Critical Flaws, Emergency Patches Coming Tomorrow
PHP has warned administrators about two critical vulnerabilities and plans to release emergency patches imminently, according to multiple reports. BleepingComputer and Ars Technica report that the patches are expected tomorrow, while Reuters notes a cyber agency warning that websites may go dark as PHP prepares the critical fix. The Hacker News describes the issue as "PHP2Shell" and references a 14:00 UTC PHP RCE patch, offering guidance on what actually protects systems before the patch and what does not. Aikido Security also urges users to stay tuned for php2shell mitigation and patches. The flaws are described as critical, and the emergency patches are intended to address them. Administrators are advised to prepare for potential disruptions and apply the fixes promptly once released.
Read source