PHP2Shell: Two Critical Remote Code Execution Flaws in PHP
27 October 2026 | CVE-2026-109618 and CVE-2026-109619 | CVSS v4.0: 9.2 each On 21 October 2026 the PHP project published a security advisory for two critical PHP2Shell, these bugs can under certain conditions enable unauthenticated remote code execution (RCE). This is not a WordPress plugin or One note on the name: "PHP2Shell" does not appear in the advisories published by the PHP Branch Affected First fixed 8.5 < 8.5.12 8.5.12 8.4 < 8.4.27 8.4.27 8.3 < 8.3.36 8.3.36 8.2 < 8.2.35 8.2.35 8.1 and
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.