PHP Releases Emergency Patches for Critical "PHP2Shell" Remote Code Execution Vulnerabilities

On October 21, 2026, the PHP development team rolled out emergency security patches for PHP versions 8.2, 8.3, 8.4, and 8.5 to remediate a pair of critical vulnerabilities collectively dubbed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). Affecting PHP versions 5.4 through 8.5, the flaws exist in the core interpreter and allow unauthenticated remote attackers to execute arbitrary code. Uncovered by researchers at Calif (assisted by OpenAI's GPT-5.6 Sol model) and independently identified by Google's Wiz team, the vulnerabilities were targeted by multiple threat actors in the wild even before public disclosure, prompting urgent global advisories from cybersecurity agencies.