PHP2Shell: Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Explained
Category: Cybersecurity News | Web Security | Published: October 22, 2026 | Reading time: about 14 minutes On October 21, 2026, the PHP project shipped an emergency security release that fixes two critical remote code execution flaws in the PHP interpreter itself. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively nicknamed PHP2Shell, each carry a CVSS v4.0 score of 9.2. Because the bugs live in the language runtime rather than in any single framework or plugin, they reach a very large share of the web, from small WordPress sites to enterprise applications and hosting platforms. This post explains what was disclosed, how the flaws work at a conceptual level, who is exposed, how to check your own systems, and exactly what to do about it. Action required today. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor’s patched package). The PHP team states that updating is the only complete fix. Configuration workarounds exist but only clo...