{"id":"thehackernews-8231b6f9ea3f","seq":2910,"kind":"news","title":"PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert","url":"https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html","permalink":"https://vulnpulse.app/items/thehackernews-8231b6f9ea3f","summary":"This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory. PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. ⚡","severity":"critical","techs":["php"],"cves":[],"tags":["security"],"source":{"id":"thehackernews","name":"The Hacker News"},"published_at":"2026-10-21T09:05:17.000Z","fetched_at":"2026-10-21T16:17:48.024Z"}