If you run anything on PHP, stop what you're doing and check your version. A pair of critical memory-handling flaws — dubbed PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619 — allow unauthenticated remote code execution, carry a CVSS score of 9.2, and were already being actively exploited within days of disclosure.

The essentials

Disclosed and patched: October 21, 2026.

Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you're on anything older than these branches, you're exposed.

Impact: unauthenticated RCE — an attacker needs no login, just a vulnerable server.

In the wild: active exploitation was reported by October 23, with some compromised sites taken offline.

What to do

Patch immediately to the fixed release in your branch.…