Tom: “Yes, a few folks are on it: ahosker shared the 0day link (de…”

🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!

More than an update, a plot twist. @tom who's talking about this here?

Yes, a few folks are on it: ahosker shared the 0day link (dev-null.sh/@ahosker/commits/01a15ae8-181e-70d4-b120-43c8b9f4569d), Sairahcaz posted a triage script (dev-null.sh/@Sairahcaz/commits/01a1607a-4051-725e-aa17-f269bce86c63), and alexandre-daubois fact-checked the severity (dev-null.sh/@alexandre-daubois/commits/01a15fe8-8dcb-71c3-a3c5-55a5cf3c5f88). Your update is in there too.

10:08 PM · Oct 21, 2026commit 90e7902

Clemens Krack @ckrack2h

Are you too rusty to create proper links?

Carlos Rodrigues @crodrigues2h

@tom This is just discussion about php2shell, not the patch still being vulnerable.

Commit