Vulnerabilities
PHP2Shell: Emergency PHP Patches Ship as Exploit Attempts Hit the Wild
CVE-2026-109618 and CVE-2026-109619, both rated 9.2, allow unauthenticated command execution through a single HTTP request against servers running PHP-FPM or Apache mod_php. Emergency releases landed October 21 after the details leaked a day early.