The php2shell fix landed in the FreeBSD ports tree within a day, but packages had only been built for some CPU architectures, and my arm64 jail host was not among them. Instead of setting up Poudri...

On 2026-10-21 the PHP project released fixes for two critical vulnerabilities nicknamed php2shell (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2). Every PHP version since PHP 5 is affected. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.