Two critical PHP vulnerabilities known as PHP2Shell, disclosed in late October 2026, could allow remote code execution on about 70% of websites globally, yet mass exploitation reports remain limited. While emergency patches have been released alongside a subsequent fix for a related Brotli library flaw, many servers remain unpatched, and successful attacks—such as those targeting Palo Alto Networks PAN-OS devices—have demonstrated real-world impact. Experts advise urgent patching combined with thorough system audits and using specialized detection tools to identify potential compromises.
https://www.kaspersky.com/blog/php2shell-two-weeks-after-patches/56647/