Explained: What are the two PHP vulnerabilities behind a global rush to update and why it matters

Two critical security vulnerabilities in PHP, the programming language behind around 70% of the internet, were disclosed publicly on October 21, 2026, along with fixed patches. The flaws, which the Cybersecurity researcher, Ryan Austin at Calif, the US-based cybersecurity, has named “php2shell”, could let an attacker run their own code on a web server, according to a research paper published by the firm. All the PHP versions from PHP 5.4 through 8.5.11 are still vuln