Two critical RCEs in PHP core

Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial

Published 21-Oct-2026 15:49 UTC · First seen 21-Oct-2026 15:49 UTC

Sources

• Cisco Talos blog · 21-Oct-2026