News Vulnerabilities & Zero-Days
Are you ready for the storm? PHP2Shell: two unpatched critical PHP flaws (CVSS 9.2) spark RCE fears for millions of websites
The PHP security team will release fixes for two critical vulnerabilities rated CVSS 9.2 on 21 October 2026 at 14:00 UTC. CERT-EU says they could allow remote code execution. PHP powers 69.3% of websites whose server-side language is known, so teams should prepare to patch now.
Jaydeep Bhatt
