[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5fCE6qaBPOb43rY8vwalDU3iqBKJJs9xrzrATvIXdwc":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"2ab98048-96d5-4ec4-8b2f-466da55147f6","PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert","php2shell-two-unpatched-critical-php-rce-flaws-cvss-9-2-trigger-emergency-securi-8231b6","PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. Security researchers at watchTowr say the two flaws allow remote code execution. Only the four supported PHP branches, 8.2 through 8.5, can receive the fix, and no exploitation has been reported so far.","PHP announced an out-of-cycle security release on October 21 to address two critical remote code execution vulnerabilities rated 9.2 on the CVSS v4.0 scale. Discovered by watchTowr security researchers, the flaws affect supported PHP branches 8.2 through 8.5, with no active exploitation reported. Details remain undisclosed pending the patch deployment.","PHP releases emergency patch for two critical RCE flaws (CVSS 9.2) in branches 8.2–8.5.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fphp2shell-two-unpatched-critical-php.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjcxq1wmaSTaMiFJnrulXjwGrIIkIHBR3Q9Yv6Lky3rAie6XPOnFmXOVckMgVzGn9yvodrbkt6kV623Ofg8Iw-1MTDRoCVzXPiikivnZ5R7OynIF5-QC0DAiwXq8q2MRS3PZaz9NpjhJUqa-QWi1AQJ2XnJ-nvUNEvG3f1E0UpU5slUwzguAI-cESkZ5Xc\u002Fs1600\u002Fphp2shell.jpg","2026-10-21T04:57:50+00:00","2026-10-21T06:00:13.049298+00:00",9,[17,20,23],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"PHP Group","vendor",{"name":24,"type":22},"watchTowr","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[],[21,24],{"controls":44,"vendors":132},[45,74,103],{"slug":46,"name":47,"problem":48,"products":49},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":75,"name":76,"problem":77,"products":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":104,"name":105,"problem":106,"products":107},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[133],{"slug":134,"name":24,"logo_path":135,"roles":136},"watchtowr","\u002Fvendor-logos\u002Fwatchtowr.png",[137],"reported_by",{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":150},"critical-php-rce-flaws-demand-emergency-patching-response-1792563645374","Critical PHP RCE Flaws Demand Emergency Patching Response","Two critical remote code execution vulnerabilities (CVSS 9.2) in PHP 8.2–8.5 forced an out-of-cycle emergency release, highlighting the ever-present risk of unpatched runtime environments. PHP powers a vast portion of the web, meaning delayed patching exposes millions of applications to potential full server compromise. The severity of these flaws underscores why organisations must have emergency patch procedures that operate outside normal maintenance windows. Even with no active exploitation reported at disclosure, the window between public announcement and weaponisation is historically very short, making rapid response non-negotiable.",[143,144,145,146,147,148,149],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":151,"PCI DSS Requirement 6":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"CIS Control 17: Incident Response Management":154,"OWASP A06:2021 Vulnerable and Outdated Components":155,"CIS Control 7: Continuous Vulnerability Management":156,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":157},"NIS2 mandates incident handling and vulnerability management practices for essential and important entities, requiring that critical flaws in core infrastructure software like PHP be addressed as part of formal security obligations.","Requirement 6 mandates that organisations develop and maintain secure systems by protecting all system components from known vulnerabilities through the installation of applicable security patches, with critical patches applied within one month.","SI-2 requires organisations to identify, report, and correct information system flaws, including installing security-relevant software updates within defined time frames — directly mandating the emergency patch process needed here.","An out-of-cycle CVSS 9.2 disclosure is effectively a security emergency; a mature incident response capability ensures pre-defined escalation paths and patch deployment procedures are activated immediately upon such advisories.","The vulnerability exists directly within a widely deployed runtime component (PHP), and OWASP A06 specifically calls for organisations to continuously monitor and promptly update components with known critical flaws.","Continuous vulnerability scanning would have immediately flagged affected PHP 8.2–8.5 versions across the estate, enabling prioritised emergency remediation before any exploitation window opened.","This control requires timely identification and remediation of technical vulnerabilities in software in use, which would have driven a structured, time-bound response to the critical PHP RCE disclosure."]