PHP vulnerability post-mortem reveals bug was known two years ago — Small team of maintainers knew of the issue before it was made public, as new PHP2Shell chained exploit ravages servers

A newly uncovered critical vulnerability in PHP, exploited via the chained PHP2Shell attack, allows remote code execution on millions of vulnerable servers. Maintainers of the open-source language were aware of the issue for two years, while millions of installations continue running unsupported, end-of-life versions. Open article →