PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, could allow unauthenticated remote code execution, The Hacker News reports. Details of the flaws leaked ahead of disclosure, and PHP shipped an out-of-cycle emergency security release on October 21 to address them.