PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

PHP's security team has identified two critical vulnerabilities with a CVSS score of 9.2, which allow for remote code execution. An out-of-cycle security release is scheduled to address these flaws. The release will be available for PHP branches 8.2 through 8.5, which are the only supported versions eligible for the fix. So far, no exploitation of these vulnerabilities has been reported. The security release is set to be shipped at 14:00 UTC on October 21. Details of the vulnerabilities have not been disclosed by PHP's security team.