PHP2Shell: Two Critical PHP Flaws Reported as RCE, CVE-2026-109618 and CVE-2026-109619

Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each rated CVSS v4.0 9.2, permit unauthenticated remote code execution across many PHP deployments (including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed); PHP released fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35) on 21 Oct 2026 and advises immediate updates, while the advisory also lists configuration mitigations, detection guidance and notes that no confirmed indicators of compromise had been published though mass exploitation was expected by some researchers.