PHP patched two 9.2 flaws in its core. A fully updated WordPress is still exposed.

PHP shipped four security releases on 21 October 2026 — 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — fixing the two vulnerabilities now known as PHP2Shell, both rated CVSS v4.0 9.2 by the PHP security team. Th