We can now find flaws faster than anyone can fix them

Thu, 22 Oct 2026 09:00:00 -0700

On October 21, 2026, the PHP project shipped an emergency security release outside its normal schedule. Two flaws in PHP’s engine - quickly nicknamed php2shell - were rated 9.2 out of 10, and they affect every version of PHP released since 2012. PHP runs roughly seven out of ten websites on the internet. The details had leaked the day before, so the release went out early, while hosting providers and security vendors scrambled to put temporary protections in front of their customers.

Php on Tolmo

We can now find flaws faster than anyone can fix them