Critical Alert: "PHP2Shell" Remote code execution vulnerabilities in PHP
Original Issue Date:-
October 23, 2026
Severity:-
Critical
- PHP 8.5 versions prior to 8.5.12
- PHP 8.4 versions prior to 8.4.27
- PHP 8.3 versions prior to 8.3.36
- PHP 8.2 versions prior to 8.2.35
Multiple vulnerabilities have been reported in PHP which could allow a remote attacker to execute arbitrary code on the targeted system.
Target Audience:
All organizations and individuals using PHP.
Risk Assessment:
High risk of remote code execution and complete system compromise.
Impact Assessment:
Potential for remote code execution and compromise of the affected systems.
PHP is an open-source scripting language designed for server-side web development, enabling the creation of dynamic webpages.
These vulnerabilities exist in PHP due to memory corruption and improper resource control. A remote attacker could exploit these vulnerabilities by sending a specially crafted request to the targeted system.
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code and compromise of affected systems on the targeted system.
Note: Multiple reports confirm large scale exploitation in the wild, users are advised to patch urgently.
Apply appropriate security updates and mitigations as recommended below:
PHP