PHP2Shell (CVE-2026-109618/109619): What to Do Right Away
On October 21, 2026, the PHP project released an emergency patch for two critical vulnerabilities, dubbed PHP2Shell, that allow code to be executed on a server without any credentials. They affect every PHP-based site, not a single CMS: WordPress, PrestaShop, ...