Why this site exists
On 21 October 2026 the PHP project fixed two critical flaws in PHP itself. The facts were spread over an announcement, two advisories, a changelog and a lifecycle table, and the answer for old versions was a source branch most site owners cannot use. This site puts those facts in one place, with their sources, and keeps them current.
Who runs it
php2shell.dev is run by SafeMPC Labs. We are not affiliated with or endorsed by The PHP Group or the PHP Foundation.
How it is paid for
The fix information is free and stays free. We earn money from optional paid help. In future some recommendations may be affiliate links; each will be marked "Paid link" and listed on disclosure.
How we work
Every fact on the site links to its source, usually php.net or the official advisories. When something changes, we update the page and add an entry to the changelog. The rules are on editorial policy.
Contact
Use the chat on the home page or email. Security reports about this site: security.
Last reviewed on 22 October 2026.