PHP ships emergency patches for critical PHP2Shell flaws

T1Covered by 1 source · first reported by BleepingComputer at 21 Oct, 14:07 UTC

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]

releasessecurity

Sources

• T1PHP ships emergency patches for critical PHP2Shell flawsBleepingComputer21 Oct, 14:07

Vulnerabilities

• CVE-2026-109618
• CVE-2026-109619