
PHP patched two 9.2 flaws in its core. A fully updated WordPress is still exposed.
PHP shipped four security releases on 21 October 2026 β 8.5.12, 8.4.27, 8.3.36 and 8.2.35 β fixing the two vulnerabilities now known as PHP2Shell, both rated CVSS v4.0 9.2 by the PHP security team. Th









