PHP2Shell: critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities in the core of PHP, known together as PHP2Shell. Both are rated 9.2 (CVSS 4.0)…