PHP2Shell: two critical PHP vulnerabilities and what to do now
On 21 October 2026, PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, two remote code execution flaws that are already being exploited. A third flaw remains unpatched.
Read the article