PHP 8.5.12 may still be vulnerable to php2shell, researchers report
basedjensen · x · 2026-10-22
Security researchers report a successful double-free trigger on freshly patched PHP 8.5.12, suggesting the official php2shell fixes may be incomplete.
A crash alone doesn't confirm RCE, but the researchers urge urgent investigation and warn against assuming you're safe just because you've patched.
Related event: PHP 8.5.12 Patch Incomplete: php2shell Double-Free Still Exploitable(2 posts)→
More from Safety
- Amid rising cyberattacks, a 6-step personal security checklist worth doing today — peterwildeford · 2026-10-22
- GPT-5.6 Sol and Gemini 4 Argon both found a critical PHP flaw affecting millions of sites — The Decoder · 2026-10-22
- 136-Country, 118M-Article Dataset Audits State Media Share in LLM Training Corpora — deliprao · 2026-10-22
- Cloudflare's security-audit-skill hits 35.7k stars, turns coding agents into auditors — Pytlicek · 2026-10-22
- Wiz: stolen credentials from LiteLLM supply chain incident already abused for LLMJacking from two tracked IPs — wunderwuzzi23 · 2026-10-22
- The Supply Chain Dilemma: Patch Fast for Vulnerabilities, Slow for Backdoors — jd_pressman · 2026-10-22