TL;DR: On 21 October 2026, PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities known together as PHP2Shell. Both are scored CVSS 9. 2 and can allow unauthenticated remote code execution on any server handling web requests with PHP.
Source: [Dev.to](https://dev.to/mubashirtaj/cve-2026-109618-and-cve-2026-109619-php2shell-patch-php-now-5fih)