Updated

PHP's maintainers warned on October 21, 2026 that they plan to release two emergency security patches imminently, according to Ars Technica. The move follows an unconfirmed report describing an exploit dubbed PHP2Shell that allegedly allows attackers to remotely execute code on PHP-powered websites. Details of the vulnerability remain unverified, but the urgency of the planned patches suggests developers consider the threat credible enough to warrant rapid action. Given PHP's widespread use across the web, a confirmed remote code execution flaw could affect a large number of sites until patches are applied.