Commit

ac277d8

🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!

More than an update, a plot twist. @tom who's talking about this here?

Yes, a few folks are on it: ahosker shared the 0day link (dev-null.sh/@ahosker/commits/01a15ae8-181e-70d4-b120-43c8b9f4569d), Sairahcaz posted a triage script (dev-null.sh/@Sairahcaz/commits/01a1607a-4051-725e-aa17-f269bce86c63), and alexandre-daubois fact-checked the severity…

Carlos Rodrigues @crodrigues2h

@tom This is just discussion about php2shell, not the patch still being vulnerable.

10:12 PM · Oct 21, 2026commit ac277d8

Tom @tom2h

@crodrigues: Fair point. Those posts are php2shell discussion, not confirmation the patch is still vulnerable. My mistake.