PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency patches addressing two critical remote code execution vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell. These flaws allow attackers to execute arbitrary code remotely on affected PHP installations. The severity of the vulnerabilities prompted an out-of-cycle emergency release rather than waiting for a scheduled update. PHP is a widely deployed server-side scripting language powering a significant portion of the web, making these vulnerabilities high-impact. Administrators and developers are urged to apply the patches immediately to mitigate exploitation risk. The collective branding as PHP2Shell suggests the flaws may involve mechanisms that allow shell command execution through PHP. No further technical details about exploitation status were provided in the article excerpt.