PHP2Shell: Two Critical PHP Flaws Put Millions of Sites at Risk — Check Your Version and Fix It Today
CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) allow unauthenticated remote code execution in PHP itself. Patches exist only for PHP 8.2 and newer: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today. On PHP 8.1 or older there is no patch — here is exactly what to do.