PHP2Shell is a pair of high-impact vulnerabilities in PHP versions 5.4–8.5 that allow remote code execution (RCE). Their existence was publicly announced on 20 October 2026. An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day.
Why the popularity?
Two newly revealed flaws in PHP allow remote code execution, meaning attackers could run their own code on affected servers.
Fixes are out, but the maintainers say no full workaround exists, so updating is the only safe move.
AI helped hunt the bugs down, and Wiz and a researcher in OpenAI's "Patch the Planet" project found them separately.
Cloudflare and Amazon both spotted signs of attacks before the fix went public, so hackers may have had a head start.
The Missing Post Office is an artwork by Japanese artist Saya Kubota as an installation for the Setouchi Triennale in 2013. It is not affiliated with Japan Post.
It is a "post office" where undeliverable letters are collected, using the former Awashima Post Office building on Awashima Island in Mitoyo City, Kagawa Prefecture.
Kubota serves as the "post office worker" of the Missing Post Office, and Katsuhisa Nakata, the former postmaster of the Awashima Post Office, as the "postmaster". The public is encouraged to send mail there, preferably on postcards. Its address is c/o Hyoryu Yubinkyoku 1317-2 Takumacho Awashima, Mitoyo Kagawa 769-1108 Japan. Continue reading →
