What people are saying on X
Recent PHP2Shell posts from government agencies, security companies, news outlets and site owners. Last updated 2026-10-21.
All organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities... If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated.
- NSA Cyber (@NSACyber) Oct 21, 2026, 9:45 AM ET
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules.
- Dane Knecht (Cloudflare CTO) (@dok2001) Oct 21, 2026, 10:09 AM ET
PHP ships emergency patches for critical PHP2Shell flaws.
- BleepingComputer (@BleepinComputer) Oct 21, 2026, 10:07 AM ET
PHP releases emergency patches for two critical #PHP2Shell RCE flaws (CVSS 9.2) as early exploit attempts emerge... PATCH NOW.
- The Hacker News (@TheHackersNews) Oct 21, 2026, 10:35 AM ET
I pre-emptively disconnected ALL my sites / VPS servers from the web... If you have a PHP website, probably good to take them down until you patch PHP.
- @levelsio (@levelsio) Oct 21, 2026, 8:44 AM ET
Our discussion forum is the only software we have using PHP. We've taken it down temporarily while waiting for the patches... Don't want to take the risk.
- GrapheneOS (@GrapheneOS) Oct 21, 2026, 4:21 AM ET
Rough estimate: likely over 1.3 million internet exposed hosts vulnerable to #PHP2Shell.
- Silas Cutler (@silascutler) Oct 20, 2026, 7:18 PM ET