
php2shell: Emergency PHP Patches for CVE-2026-109618 and CVE-2026-109619
On October 21, 2026 the PHP development team released emergency fixes for two critical memory-safety flaws, CVE-2026-109618 and CVE-2026-109619, together dubbed php2shell. Both can let an unauthenticated attacker run code on an exposed server. Here is what they are and exactly what to do.







