On 21 October 2026, PHP shipped emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are CVSS v4.0 9.2. The post PHP2Shell: the expiry date on “too hard to exploit” appeared first on Pentera .