Post

PHP's two CVSS 9.2 RCE patches landed at 00:30 this morning. The fix is server-level - your codebase cannot save you. Confirm every host actually got it (8.2.35, 8.3.36, 8.4.27 or 8.5.12), and chase the 8.1-and-older tail: https://www.secureinseconds.com/blog/2026-10-21-php2shell-patch-window