PHP shipped emergency fixes on 21 October 2026 for two critical, unauthenticated RCE bugs nicknamed PHP2Shell. Here's what's patched, what's still at risk, and what to check today.
