Security Critical “php2shell” flaw: our PHP updates are being rolled out
On Wednesday 21 October 2026 at 14:00 UTC, the PHP project released security versions fixing two critical remote code execution flaws: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 (CVSS v4.0). Researchers at watchTowr have nicknamed the pair “php2shell”. Our teams are currently rolling out the fixed versions on the servers we manage. This article explains what these flaws are, why they are taken so…
Read the article
