Critical

PHP2Shell: Two Critical PHP RCE Flaws, CVE-2026-109618 and CVE-2026-109619

PHP warned of two critical remote code execution flaws, both rated CVSS 4.0 9.2, ahead of an emergency release on October 21. Here is what is confirmed, what is not, and how to prepare before the details are published.