PHP2Shell: the critical PHP security release of 21 October 2026, and how to apply it to your servers
Two critical flaws in the PHP runtime itself allow remote code execution without a login. What happened, who is exposed, how to check every server you have, how to apply the fix on each platform, what to do if you cannot patch today, and what to check afterwards.