PHP Just Patched Two Critical RCE Flaws — But the Exploits Are Already Out

Michael Miller · 2026-10-21

If you run anything on PHP, this one deserves your attention today. The PHP team pushed out emergency updates for two critical flaws that let an attacker with no account at all run code on your web server. Not a plugin. Not a theme. The language itself. The fixes landed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. According to the PHP team, updating is the only thing that fully protects a server. Not a workaround, not a config tweak — an actual version bump. ### Why PHP2Shell Is Different From Your Typical Plugin Bug Here's the part that makes people sit up. The flaws — grouped together under the name PHP2Shell — live in the PHP runtime. That means they exist underneath every application you've built or installed. So even if your own code is clean, even if you've patched every dependency you know about, the exposure is still there. That's the uncomfortable reality of a runtime-level bug. It doesn't care how careful your application is. As one security engineer put it during the disclosure chatter: *"You can't patch your way out of a hole that's below your code. You have to patch the floor."* That's exactly what this is. ### What "No Account Required" Actually Means Most exploits you hear about need something first — a login, a stolen session, a misconfigured admin panel. This one doesn't. An attacker without credentials can trigger remote code execution on an affected web server. That's the difference between a locked door someone can pick and a wall with a hole in it. There's no key to steal because there's no lock involved. And exploit attempts are already showing up in the wild. That's the part that turns a "patch when you can" situation into a "patch now" situation. ### The Versions You Need to Check Here's the short list of patched releases: - PHP 8.5.12 - PHP 8.4.27 - PHP 8.3.36 - PHP 8.2.35 If you're on an older branch that's no longer receiving security fixes, this is a good moment to think about moving up. Running an unsupported version means you're not just missing this patch — you're missing the next one too. ### How to Handle This Without Panicking You don't need to take your whole stack offline. But you do need to move with some urgency. A few practical steps: - Check your current PHP version right now. It takes thirty seconds. - Update to the matching patched release for your branch. - Verify the update actually applied — don't trust the deploy log alone. - Watch your server logs for unusual outbound requests or odd process behavior over the next few days. - If you manage client sites or shared hosting, confirm your provider has patched too. That last point matters more than people think. Plenty of sites sit on managed infrastructure where the owner assumes someone else handled it. Sometimes they did. Sometimes nobody did. ### The Bigger Lesson Here Runtime vulnerabilities are a reminder that security isn't just about the code you write. It's about the ground everything stands on. PHP powers a huge share of the web, which is exactly why flaws like PHP2Shell get attention fast. The good news? The fix exists, it's available, and it's not complicated. The bad news? Exploit attempts are already circulating, so the window for a relaxed approach has closed. Update today. Then check again tomorrow to make sure it stuck.