PHP2Shell: Critical Unauthenticated RCE Flaws in PHP Core (CVE-2026-109618 and CVE-2026-109619)
2026-10-22
Read Time: 4 minutesPHP2Shell: Critical Unauthenticated RCE Flaws in PHP Core (CVE-2026-109618 and CVE-2026-109619) On 21 October 2026 the PHP project released emergency updates that fix two critical remote-code-execution vulnerabilities in the PHP runtime itself. Tracked as CVE-2026-109618 and CVE-2026-109619 (collectively dubbed PHP2Shell), both carry a CVSS v4.0 score of 9.2. They affectRead More →