LatestCovered by 2 sources — first reported by The Hacker News, Oct 21, 09:05 UTCPHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertCoverageOct 21, 09:05 UTCThe Hacker NewsPHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertOct 21, 14:07 UTCBleepingComputerPHP ships emergency patches for critical PHP2Shell flawsVulnerabilities in this storyCVE-2026-109618Critical 9.2CVE-2026-109619Critical 9.2