PHP2Shell: two critical PHP engine flaws leaked before disclosure, emergency patches issued, exploitation attempts since 17 October
Two critical vulnerabilities in the PHP engine, collectively referred to as PHP2Shell, prompted emergency security releases on 21 October 2026 after details leaked on 20 October ahead of the planned disclosure. The UK NCSC urged organisations to identify affected systems and update immediately, and Amazon threat intelligence reported expl…