PHP2Shell: two critical PHP engine flaws exploited from Oct 17, leaked before disclosure; patches released Oct 21, government sites taken offline
Two critical vulnerabilities in the PHP engine, collectively dubbed PHP2Shell, were fixed in emergency security releases on October 21, 2026 after details leaked ahead of the planned disclosure (darkreading.com, itsecurityguru.org). Amazon Web Services (AWS) honeypot logs show at least one actor attempting exploitation from October 17, fo…