PHP2Shell: patch it calmly and ignore the exploit sellers on X
· 10 min read
PHP2Shell is the name for two use-after-free flaws in the PHP engine, and PHP shipped the fixes on October 21, 2026. My position: patch on your normal urgent schedule, check the exploit conditions against your own servers, and do not download or run anything a stranger on X calls an exploit or a fix. The bugs deserve a patch, the panic deserved much less, and the exploit and fix scripts shared on social media were worse than useless.