Security
PHP2Shell: two critical RCE flaws get emergency patches in PHP 8.x
On 21 October 2026, PHP's security team shipped emergency fixes for two unauthenticated remote code execution flaws that were already under attack. Every install that serves web requests is affected, and updating is the only defence that lasts.