Sources
This guide is based on these reports, as of 22 October 2026. Where they disagree, we've gone with the PHP project's own figures. If something here is out of date, the PHP advisory and your vendor's notices take priority.
Government advisories
- CISA (US): Critical vulnerabilities in PHP require immediate patching
- NSA (US): Critical patches recommended for PHP vulnerabilities
- UK NCSC: Critical security issue affecting PHP
- EU joint statement on critical PHP vulnerabilities (European Commission, ENISA, CERT-EU, Europol EC3, CSIRTs network)
- NCSC Ireland advisory (PDF)
- NCSC-NL (Netherlands): software that includes PHP
Vendor advisories
- PHP project: security release of 21 October 2026. Fixed versions, mitigations, and backports for 7.4, 8.0 and 8.1. The PHP project doesn't use the name “PHP2Shell”; it's the name the security industry adopted.
- Ubuntu USN-8948-1 and USN-8948-2
- Debian security tracker
- Red Hat security bulletin RHSB-2026-013
- cPanel EasyApache 4 change log
- CloudLinux: PHP fixes
- Plesk Obsidian change log
Reports and analysis
- BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws. Fixed versions, temporary fixes and the disclosure timeline.
- Help Net Security: PHP2Shell vulnerabilities patched. Affected setups and the first exploitation attempt, on 17 October.
- Cloudflare: protections against PHP2Shell. Firewall rules on all plans, including free.
- Imperva: PHP2Shell technical analysis. Root cause and signs of exploitation.
- watchTowr: PHP2Shell FAQ. Exploitation seen in the wild.
- Sophos: PHP2Shell advisory
- Sansec: PHP2Shell research
- The Hacker News: PHP2Shell
- SecurityWeek: mass exploitation looms