Announcements

Security Advisory: Critical PHP Vulnerabilities ("PHP2Shell") — Update Now

Friday, October 23rd, 2026

On 21 October 2026 the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (nicknamed “PHP2Shell”). Both are rated 9.2 (critical) and can let an attacker run their own code on a web server without logging in. Attempts to exploit them have already been reported. Which PHP versions a…