PHP2Shell: Two Critical PHP Vulnerabilities Discovered — Update Your Server Now
Published: October 22, 2026 Two critical security vulnerabilities have been discovered in PHP, potentially allowing attackers to execute malicious code on vulnerable web servers without logging in. Disclosed on October 21, 2026, the vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Collectively referred to in security reporting as PHP2Shell, they affect PHP’s core runtime rather than…