
PHP2Shell's two critical PHP flaws, explained
PHP2Shell is two PHP flaws rated 9.2 that can let one request take over a web server. How they work, who is exposed and what fully fixes them.
Editor, Tech AI Wire
Claire Whitmore edits every article on Tech AI Wire: picks which stories are covered, reads every draft, checks each figure and quote against the sources the article links to, edits the text, and approves it before it is published. Claire Whitmore is the pen name the editor publishes under.
Drafts are prepared with AI from those named sources, and each article says so under its byline. Since November 2026 every article must also add something the other coverage does not have: a hands-on test, an original table built from primary sources, or a close reading of the primary document. Translations are machine-produced from the edited English article, and the English version governs.
Found a mistake? See the corrections policy or write to contact@techaiwire.com. The full standards are in the editorial policy.

PHP2Shell is two PHP flaws rated 9.2 that can let one request take over a web server. How they work, who is exposed and what fully fixes them.

Linux 7.4 adds a Valve-backed driver for Joy-Con 2, Pro Controller 2 and GameCube NSO controllers after 16 revisions. Only USB works for now.

Micron's Taoyuan union began a 24-hour strike on October 22, 2026, asking for 15% of operating profit. Production was not halted. Talks resume Oct. 23.

Bun 1.4.4, released October 22, 2026, adds bun fmt, a Prettier-compatible formatter Bun says checks Prettier's own repo 286x faster than Prettier.

Meta's Q3 2026 revenue rose 26% to $64.6 billion, but $34.9 billion of capex and a $9.9 billion legal charge pushed free cash flow negative.

Python 3.15.1, 3.14.9 and 3.13.17 arrived on October 21, 2026, bundling pip 26.2.2 and certifi 2026.10.19 to stop trusting the eMudhra CA.

PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix two flaws rated 9.2. PHP says updating is the only complete fix.

PHP ships fixes for two critical flaws rated 9.2 at 14:00 UTC on October 21. Only 8.2 to 8.5 get patches, and details leaked a day early.

TypeScript 7.1 Beta brings back a programmatic API for tools stuck on 6.0, adds content mappers for .vue files and type-checks up to 1.9x faster than 7.0.

COSMIC Epoch 1.11 keeps modal dialogs on top with Wayland's xdg-dialog-v1 and sends games to the right GPU on hybrid laptops, 12 days after 1.10.

Private keys for 8 eMudhra intermediate certificates were exposed. Browsers blocked them within hours; Go 1.27.3, certifi and NSS 3.131.1 now block them too.

A power event in one London zone took down Google Cloud services for nearly 8 hours on October 20, 2026, and Revolut lost payments, transfers and sign-in.