The php2shell Scare Showed How Much Runs on PHP
The php2shell scare pulled PHP onto front pages worldwide, from Japan's prime minister to the NSA, and showed how much of the internet quietly runs on it.
PHP News — Everything happening in PHP
Partners who support PHP News
Latest PHP News
PHP Warns of Another Session Upload Progress RCE Path
The PHP security team says to set session.upload_progress.enabled=0 until the next bugfix release to block a rare RCE path, CVE-2026-115560.
Chainguard Broke the php2shell Embargo
Chainguard CEO Dan Lorenc says exploit reports justified shipping PHP RCE fixes before the embargo lifted. The reports don't hold up, and it was the wrong call.
PHP Foundation Explains the RCE Bugs and the Disclosure Leak
The PHP Foundation says the OOM bug behind today's PHP RCE fix was first spotted in 2024, the fix stalled for months, and a leak moved the release up a day.
php2shell: How OpenAI Coordinated the PHP RCE Disclosure
OpenAI says its Patch the Planet program coordinated the php2shell disclosure after Calif used GPT-5.6 Sol to find a critical PHP bug Wiz also reported.
More stories
All stories →- PHP Fixes Two Critical Remote Code Execution Bugs - Update Today!
- PHP Social Network Built Live in 48 Hours With JetBrains Air
- Automattic Applies for a .php Top-Level Domain
- PHP 8.7 RFC: Comments and Trailing Commas in json_decode()
- The History of PEAR, PHP's First Package Manager
- elephc: A PHP Compiler That Builds Native Binaries
- PHP 8.6 RC3 is out and ready for testing
- Meet PHPMD 3.0: New CLI, New Config, PHP 8 Attributes
- LLPhant: Build AI and RAG Apps in PHP
- PHP Io\Terminal RFC Proposes Native Terminal Input for CLI
PHP news in your inbox
The most important news, tutorials, and packages—curated for working PHP developers.