PHP2Shell vulnerabilities force web servers to update worldwide
Two PHP vulnerabilities known as PHP2Shell, disclosed on October 21, 2026, allow code execution on web servers without an account or password. The PHP development team released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and urged immediate installation. Governments in Europe, Asia and the United States asked users to update or disconnect systems. In Colombia, Colcert reported 8,699 PHP services exposed to the internet and issued a high-risk alert.


















