php2shell

Updated: 28 October 2026

Please contact me if you need assistance dealing with the php2shell vulnerability.

The following versions of PHP fix two critical vulnerabilities that can allow unauthenticated remote code execution:

8.5.12
8.4.27
8.3.36
8.2.35

• Cloudflare deploys protections against php2shell vulnerability
• Changelog · Cloudflare Web Application Firewall (WAF) docs
• NCSC: Preparing for a ‘vulnerability patch wave’
• Security advisory: Critical remote code execution vulnerabilities, update now