On October 21, the PHP project released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now widely referred to as “PHP2Shell.” Both are rated CVSS 9.2 and allow an unauthenticated attacker to run code on a server with a single crafted web request. The post PHP2Shell: What Teams Need to Know About CVE-2026-109618 and CVE-2026-109619 appeared first on Remedio .