PHP2Shell: Two Critical PHP RCE Flaws (CVSS 9.2) Unpatched Ahead of 14:00 UTC Fix; Upload-Progress Workaround Insufficient
Two critical PHP flaws dubbed PHP2Shell, each rated 9.2 out of 10, are due to be fixed in a PHP release at 14:00 UTC on October 21, 2026. PHP has not said which versions or components are affected and has offered no workaround of its own. No exploitation has been reported, and the flaws were absent from CISA's KEV catalog when last checke…