CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Payload authentication token field handling issue

Published Oct 7, 2026 · updated Oct 7, 2026

What to do

  1. Upgrade to a fixed version: payload 3.90.0, payload 4.0.0-canary.34.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

payload

>= 3.0.0, < 3.90.0
3.90.0

Check your project: npm ls payload --all

Is payload@3.90.0 safe to install? See the upgrade verdict →

payload

>= 4.0.0-canary.0, < 4.0.0-canary.34
4.0.0-canary.34

Check your project: npm ls payload --all

Is payload@4.0.0-canary.34 safe to install? See the upgrade verdict →

Sources

← All critical vulnerabilities