PHP2Shell: what you can do right now
Two critical PHP vulnerabilities, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), let an attacker run code on a web server without logging in. PHP rates both 9.2 out of 10 and is shipping fixes on 21 October 2026 at 14:00 UTC. Details leaked a day early, and attacks have already been reported. If your site runs on








