PHP2Shell — Critical PHP Flaws Let Attackers Take Over Web Servers (2026)
Two critical PHP flaws dubbed PHP2Shell (CVE-2026-109618, CVE-2026-109619) let attackers run code on web servers without logging in. Patches arrived October 21, 2026 — attacks started days earlier.