PHP to ship out-of-cycle fix for two unpatched CVSS 9.2 RCE flaws ("php2shell") after embargo leak; no exploitation reported
The PHP security team announced an out-of-cycle release for 14:00 UTC on October 21, 2026, fixing two vulnerabilities rated CVSS v4.0 9.2. The notice did not describe them. watchTowr says both allow remote code execution, and researchers are calling the pair php2shell, a name that is theirs, not PHP's. The notice followed an October 20 le…