Threat Pulse 62High
PHP2Shell details leak during embargo; UK NCSC tells orgs to patch or go offline
Severity 8PatchedconfirmedWeb servers and gatewaysGovernmentAI-related

Around 15:00 UTC on October 20 the two CVE IDs leaked on forums, then a reporting firm briefly posted a proof-of-concept video and Chainguard published patched images hours early. The PHP Foundation moved its release forward a day. The UK NCSC told organizations to prepare to update PHP immediately or take systems offline until mitigated.

What to do: Patches released October 21; EOL PHP 5.4 to 8.1 depend on vendor or community backports.

AI angle: The PHP Foundation said it had scanned PHP earlier in 2026 with Claude Mythos and validated reports with OpenAI's Daybreak.

· 15 days ago · The Next Web
SourcesThe Next WebITProSecurityWeek
On X
@NCSCunverified

The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.

Open on X
Why this score

Every PHP server (impact 4), details public before fix with attempts under way (exploitability 2), government services at stake (criticality 2).

Back to the board

Updated Nov 5, 01:43 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.