PHP2Shell follow-up: Emergency patch for two RCE flaws across all PHP 8.x versions; exploits spread first after coordinated disclosure leaked (community reports)

Verified (fact)

According to a post by Simon Willison highlighting a PHP Foundation announcement, a security update has been released fixing two remote code execution vulnerabilities in all PHP 8.x versions. Information leaked during the coordinated disclosure process, and exploits were circulating from the night before the patch was released. According to the PHP Foundation, the two CVE numbers spread on online forums and social media around 15:00 UTC on October 20, and the disclosure time and CVSS 10.0 score circulating alongside them were both incorrect. A Reddit post claimed websites worldwide were taken down ahead of the patch. According to Wiz's announcement as summarized by GeekNews, the vulnerabilities are memory safety issues in the PHP engine rather than in application code, and affect versions from PHP 5.4 onward.

Needs fact-check (claim)

Wiz said it found the vulnerabilities using AI.

Why it matters (interpretation)

Services running on PHP need to upgrade immediately. The incident also shows that as AI speeds up vulnerability discovery, a single leaked disclosure process can put global web infrastructure at risk all at once.

Sources

• Community Today's PHP Security Release, and How We're Strengthening PHP Security Simon Willison
• Community Websites taken down worldwide as critical PHP cyber-security update issued Reddit
• Community PHP2Shell: AI로 PHP의 치명적인 원격 코드 실행 취약점 발견 GeekNews

Story thread

1. 2026-10-21 Wiz says it used AI to find 'PHP2Shell', a critical remote code execution flaw in PHP (via community)
2. 2026-10-21 PHP2Shell follow-up: Emergency patch for two RCE flaws across all PHP 8.x versions; exploits spread first after coordinated disclosure leaked (community reports)
3. 2026-10-22 PHP remote code execution flaw follow-up: Korea's science ministry and KISA raise private-sector cyber alert from 'Attention' to 'Caution' (report)

More about PHP Foundation

• 2026-10-22 P2 Policy Unconfirmed KoreaAI security Ministry of Science and ICTKorea Internet & Security AgencyPHP Foundation
  PHP remote code execution flaw follow-up: Korea's science ministry and KISA raise private-sector cyber alert from 'Attention' to 'Caution' (report)

  According to AI Times Korea (인공지능신문), Korea's Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) on October 22...

• 2026-10-21 P1 Other Announced AI securityAgents OpenAIPHP Foundation
  OpenAI unveils Patch the Planet for joint response to critical agent-found vulnerabilities, after two months on the PHP response

  OpenAI has unveiled Patch the Planet, an effort connecting security researchers, maintainers, and incident responders to address...