{
  "id": 15978796,
  "title": "Investigating the Return of the PHP2Shell Nightmare",
  "url": "https://urgent.news/2026/10/22/investigating-the-return-of-the-php2shell-nightmare",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-22T00:56:06.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/tanahiro2010/investigating-the-return-of-the-php2shell-nightmare-eee"
  },
  "original_language": "en",
  "account": "On October 20, 2026, PHP announced a critical security release scheduled for October 21 at 14:00 UTC (23:00 JST). The vulnerabilities involved two CVE numbers, both with a CVSS v4.0 score of 9.2. The release would detail affected versions and fixed versions once confirmed. PHP mentioned the possibility of releasing earlier if needed, but did not specify CVE numbers, classify the issues as RCE, or mention session.upload_progress. The vulnerability claims circulated before the official notice.",
  "summary": "The public PoC claiming “RCE via a PHP core UAF” did not work in my lab. After reading the official patches, the actual causes turned out to be state corruption during OOM handling and state left behind across requests—not a zval UAF within a single request. What this article concludes I built a local Docker lab to investigate the PHP vulnerability making headlines as “php2shell,” compared the…",
  "key_points": [
    "PHP announced critical security release on October 20, 2026.",
    "Two CVE numbers with CVSS v4.0 score of 9.2 identified.",
    "Vulnerabilities possibly released earlier if needed."
  ],
  "editors_take": "The rapid circulation of vulnerability claims ahead of official disclosures forces developers to prepare for high-severity remote code execution risks before patches are even formally released.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}