Joomla - GoKawiil

PHP patches two critical flaws affecting 70% of websites, active exploitation reported

PHP issued an emergency security update fixing two critical vulnerabilities that let attackers run arbitrary code on vulnerable servers, affecting software behind Drupal, Magento, Joomla and WordPress. Researchers at Wiz, who helped discover the bugs along with OpenAI, say every PHP version released in the past decade contains at least one flaw, and Cloudflare and Reuters reported active exploitation and government site outages following disclosure.

krebsonsecurity.com · 2026-10-21

PHP core memory-safety flaws tracked as two CVEs under 'PHP2Shell' name

Researchers disclosed PHP2Shell, a set of memory-safety vulnerabilities in PHP's core, covering two CVEs related to out-of-memory corruption and stale global state persisting across requests. The flaws affect any site running vulnerable PHP versions, even simple applications with secure code, and are not tied to any specific CMS. WordPress, Drupal and Joomla were used only as demonstration targets for unauthenticated remote code execution, and the PHP team has released fixes.

php2shell.com · 2026-10-21