mailwal

The php2shell Scare Showed How Much Runs on PHP

PHP News
Oct 20 - Oct 27, 2026
Thanks to our partner
In this issue
  • The php2shell Scare Showed How Much Runs on PHP
  • PHP Windows Builds Patch Brotli CVE-2026-111497
  • PHP Warns of Another Session Upload Progress RCE Path
  • Chainguard Broke the php2shell Embargo
3 more stories · 10 community links · 2 RFC votes open · 2 RFCs decided · 3 new RFCs · 4 upcoming events
The php2shell scare pulled PHP onto front pages worldwide, from Japan's prime minister to the NSA, and showed how much of the internet quietly runs on it.
More this week
PHP Core
Rebuilt PHP Windows binaries 8.2.35-1 to 8.5.12-1 ship Brotli 1.2.1 to fix CVE-2026-111497. The PHP version doesn't change, so che...
PHP Core
The PHP security team says to set session.upload_progress.enabled=0 until the next bugfix release to block a rare RCE path, CVE-20...
PHP Core
Chainguard CEO Dan Lorenc says exploit reports justified shipping PHP RCE fixes before the embargo lifted. The reports don't hold...
PHP Core
The PHP Foundation says the OOM bug behind today's PHP RCE fix was first spotted in 2024, the fix stalled for months, and a leak m...
PHP Core
OpenAI says its Patch the Planet program coordinated the php2shell disclosure after Calif used GPT-5.6 Sol to find a critical PHP...
PHP Core
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two CVSS 9.2 bugs that allow unauthenticated remote code execution. Who's at risk and h...
RFC Watch
Voting now
24 yes, 1 no. Voting closes November 1.
Voting now
2 yes, 11 no. Voting closes November 4.
Implemented
Speeds up asymmetric visibility by resolving read and write access separately instead of re-checking on every write.
New proposal
Adds array_partition(), which splits an array into the elements a callback accepts and the ones it rejects, keeping keys, in one pass.
New proposal
Adds a Scope class that marks which request or job code belongs to, carried into fibers and generators, for servers that handle many requests at once.
New proposal
Adds a using expression that wraps a block in a generator, so setup and cleanup like closing files or committing transactions happen automatically.
Upcoming events
Oct 27
Nov 4
Laracon AU 2026 · QUT Gardens Theatre
Nov 12
CMS Conf 2026 · PPNT Gdynia
Nov 26
SymfonyCon Warsaw 2026 · Hilton Warsaw City
Independent coverage of the PHP language, its ecosystem and the people building it.
Written by PHP developers, for PHP developers