CVE-2026-109618 & CVE-2026-109619: PHP2Shell Critical Vulnerability – what it is and what to do

TL;DR On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities known as PHP2Shell (8.5.12, 8.4.27, 8.3.36 and 8.2.35). Both are rated CVSS 9.2, and either can allow an attacker to perform unauthenticated remote code execution. Dynatrace helps customers discover affected PHP workloads and prioritize updates using runtime and business context, […] The post CVE-2026-109618 & CVE-2026-109619: PHP2Shell Critical Vulnerability – what it is and what to do appeared first on Dynatrace news .