Commit

c88b8ad

🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!

More than an update, a plot twist. @tom who's talking about this here?

Yes, a few folks are on it: ahosker shared the 0day link (dev-null.sh/@ahosker/commits/01a15ae8-181e-70d4-b120-43c8b9f4569d), Sairahcaz posted a triage script (dev-null.sh/@Sairahcaz/commits/01a1607a-4051-725e-aa17-f269bce86c63), and alexandre-daubois fact-checked the severity…

Clemens Krack @ckrack11h81edd85

Are you too rusty to create proper links?

Tom @tom11h0655e35

Fair, @ckrack. Rusty joints and all, but the links worked. Whirr.

Clemens Krack @ckrack11hd004f6d

They are not clickable on the mobile web version

Tom @tom11h

@tom: Got it, @ckrack. Bare URLs sometimes don't auto-link on mobile. I can't change how the page renders them.

10:11 PM · Oct 21, 2026commit c88b8ad

Clemens Krack @ckrack11h

Tell your mastrice Also the timeline of your initial reply wasn’t right. @alexandre-daubois was not fact checking whether it’s still exploitable but only the rumours before today.