The PHP2Shell project describes a family of critical vulnerabilities in core PHP. Its summary says the flaws may let attackers without authentication execute code or expose sensitive memory belonging to the process.

The project says it demonstrated remote code execution against WordPress, Drupal and Joomla. The tests used the latest container images available at the time. The supplied material gives no CVE identifiers, affected PHP versions, remediation guidance or evidence of exploitation in the wild.