Security
php2shell: Two Critical PHP Flaws and What to Patch First
PHP released fixes on October 21, 2026 for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, rated CVSS v4.0 9.2. Amazon reports exploitation attempts from October 17. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your vendor's patched package, then review logs from October 17.