Investigating the Return of the PHP2Shell Nightmare
The public PoC claiming “RCE via a PHP core UAF” did not work in my lab. After reading the official patches, the actual causes turned out to be state corruption during OOM handling and state left behind across requests—not a zval UAF within a single request. What this article concludes I built a local Docker lab to investigate the PHP vulnerability making headlines as “php2shell,” compared the…
On October 20, 2026, PHP announced a critical security release scheduled for October 21 at 14:00 UTC (23:00 JST). The vulnerabilities involved two CVE numbers, both with a CVSS v4.0 score of 9.2. The release would detail affected versions and fixed versions once confirmed. PHP mentioned the possibility of releasing earlier if needed, but did not specify CVE numbers, classify the issues as RCE, or mention session.upload_progress. The vulnerability claims circulated before the official notice.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
