PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

Two critical unpatched remote code execution vulnerabilities in PHP have been discovered, rated 9.2 on the CVSS v4.0 scale. PHP is preparing an out-of-cycle emergency security release scheduled for 14:00 UTC on October 21, 2026. The flaws affect all four currently supported PHP branches: 8.2, 8.3, 8.4, and 8.5. Security researchers at watchTowr confirmed the vulnerabilities allow remote code execution. No active exploitation has been reported at the time of disclosure. The vulnerabilities have been collectively referred to as 'PHP2Shell' by the security community. No CVE identifiers have been publicly assigned yet. The PHP security team has not disclosed technical details about the flaws ahead of the patch release. Users on unsupported PHP branches will not receive fixes and remain exposed. This represents a significant risk given PHP's widespread use in web applications globally.