PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

PHP has released emergency security updates to address two critical remote code execution vulnerabilities collectively dubbed 'PHP2Shell'. The flaws reside in the PHP runtime itself, meaning any site running PHP is potentially vulnerable regardless of the application code. Affected versions span PHP 8.2, 8.3, 8.4, and 8.5 branches, with fixes available in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The vulnerabilities allow unauthenticated attackers to execute arbitrary code on web servers. Active exploit attempts have already been observed in the wild, making patching urgent. The PHP team has stated that only a full update to the patched versions provides complete protection against these flaws.