PHP Foundation

PHP2Shell Fix Leaves Teams Backporting Unsupported PHP Versions

Global – November 04, 2026 -- CIQ released fixed PHP packages for Rocky Linux from CIQ Pro (RLC Pro) LTS 9.6 and 9.2 about three and a half hours after the upstream PHP2Shell fix went public, covering PHP 8.0, a version upstream no longer supports. Fixes for the php:7.4 and php:8.2 module streams followed over the next two days.

Upstream fixes skip PHP 7.2, 7.3 and 5.4

The PHP project released fixes for PHP 8.2 through 8.5 and published source-only fix branches for 7.4, 8.0 and 8.1. It released nothing for 7.2 and 7.3, or for the PHP 5.4 that CentOS 7 ships. Teams that self-support those versions must build and test the fix themselves, or the version stays exposed.

AI Turns Parked PHP Bug Into 9.2-Rated Remote Code Execution

Global – October 31, 2026 -- A PHP vulnerability that stalled in triage after a 2024 audit became unauthenticated remote code execution this year once researchers applied frontier AI models, and both PHP2Shell CVEs now carry a CVSS v4.0 score of 9.2.

PHP Foundation admits a 2024 finding stalled for lack of a proven exploit

A 2024 external audit led a PHP core developer to the first signs of an out-of-memory problem, according to the PHP Foundation's account of CVE-2026-109618. An exploit was theorized, but no one found a concrete attack vector. Each candidate fix carried a cost: a compatibility break, new denial-of-service potential, or changes to third-party extensions that seemed impossible to coordinate. Work on the fix stalled and restarted for months.