We’re live on Product Hunt.

Commit

ddd1694

Elliot @ejntaylor3h1b47dc7

🚨RCE on everything > PHP 5🚨 I think tomorrow is going to be brutal 🔥 CVSS 10 PHP release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

MPMarcel Pociot@mpociot4h

So apparently there's a PHP remote code execution zero vulnerability going to be released (and patched) on Thursday going back to PHP 5+ 😬

Attached image

Adam Hosker @ahosker2h58678aa

Its officialy CVSSv4 9.2. not 10.

Elliot @ejntaylor2h04326da

thanks for that detail - must have been a mix up from the rumour mill message I first got

Adam Hosker @ahosker2h

Seen the video? https://x.com/k_firsov/status/2112641845926989944?s=20

X (formerly Twitter)Kirill Firsov (@k_firsov) on Xphp2shell Tomorrow is a helluva day.

9:34 PM · Oct 20, 2026commit ddd1694

Elliot @ejntaylor2h

hmm I wonder if that is legit?..