CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Payload: SQL Injection in SQLite and Postgres

Published Oct 6, 2026 · updated Oct 6, 2026

What to do

  1. Upgrade to a fixed version: payload 3.88.0, payload 4.0.0-canary.27.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

payload

>= 3.0.0, < 3.88.0
3.88.0

Check your project: npm ls payload --all

Is payload@3.88.0 safe to install? See the upgrade verdict →

payload

>= 4.0.0-canary.0, < 4.0.0-canary.27
4.0.0-canary.27

Check your project: npm ls payload --all

Is payload@4.0.0-canary.27 safe to install? See the upgrade verdict →

Sources

← All critical vulnerabilities