#PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server.
#PHP2Shell
thehackernews.com
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP patches two critical RCE flaws affecting web servers as Cloudflare reports early exploit attempts, with no confirmed breaches.