PHP2Shell: Two Critical PHP Flaws, and the Controls That Decide Whether You’re Exposed
On October 21, 2026, PHP shipped emergency fixes for two critical, unauthenticated remote code execution flaws. Here’s what’s affected, what to do this week, and how the response maps to NIST, ISO 27001, CSA CCM, FFIEC, and SOX controls.