PHP2Shell: flaw in PHP versions from 5.4 already exploited in attacks on websites

The first attacks were recorded on Oct 21, 2026 at 07:43 UTC, more than six hours before the 14:00 UTC patch. Two vulnerabilities with a CVSS score of 9.2 lead to remote code execution. Patches have shipped for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.