PHP2Shell: Critical PHP Remote Code Execution Vulnerabilities Require Immediate Patching
Two critical unauthenticated RCE flaws in PHP (CVE-2026-109618 and CVE-2026-109619) were patched on 21 October 2026. Here’s what administrators need to know and do.