PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
Summary: PHP scheduled an out-of-cycle security release for 14:00 UTC on October 21 covering two critical remote code execution vulnerabilities its team rated 9.2 on CVSS v4.0, with fixes limited to the supported 8.2 through 8.5 branches. The notice followed an October 20 leak that claimed CVSS 10.0 flaws affecting PHP 5 onward would be disclosed October 22, which watchTowr confirmed as real while saying the affected scope had not been confirmed by an official vendor advisory.
Key Takeaway: Mallory counted roughly 884,000 internet-facing hosts reporting PHP 8.1 or older to Shodan on October 20 - about 59% of the 1.5 million hosts reporting any version - and those end-of-life branches will receive no vendor patch at all.