PHP ships emergency patches for critical PHP2Shell flaws
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]
Summary from BleepingComputer.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.