All news
13 articles- newsThe Register·23 Oct 20264.7New PHP2Shell exploit defeats ASLR on x86-64 servers.
- newsInfoQ·26 Oct 20264.6PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical unauthenticated remote code execution bugs; Amazon saw exploitation attempts four days before the patches.
- blogCloudflare Blog·21 Oct 20264.4Cloudflare rolled out WAF rules for the php2shell PHP RCE flaws and notes a related session upload bug, CVE-2026-115560, that affects fully patched PHP.
- newsLobsters·24 Oct 20264.4Analysis of why php2shell is not yet mass-exploited despite the panic.
- newsBleepingComputer·23 Oct 20264.3PHP shares mitigations for a new unpatched RCE in non-default configurations.
- newsBleepingComputer·22 Oct 20264.2Amazon says PHP2Shell exploitation began four days before patches.
Also in Hacker News, The Register
- newsThe Register·24 Oct 20264.1A third PHP2Shell bug was found but will not get an emergency fix.
- newsTechCrunch·24 Oct 20264.1Two dormant PHP vulnerabilities nearly broke large parts of the web this week.
- blogSimon Willison·22 Oct 20264.1PHP security release notes and plans to strengthen PHP security.
- newsThe Register·21 Oct 20264.0PHP emergency fixes for two critical bugs; unpatched sites told to go offline.
- newsArs Technica·21 Oct 20263.6PHP warns of two imminent emergency patches.
- newsThe Register·22 Oct 20263.5PHP2Shell took 32 UK government services offline.
- newsThe Register·22 Oct 20263.5PHP accuses Chainguard of exposing critical bugs early.