I spent the PHP2Shell weekend reading postmortems instead of shipping features, and the part that stuck with me was not the exploit. It was the gap between how we test code and how we actually run it.

Government sites across several European countries went offline at roughly the same time. In the Netherlands the digital identity system and personal government portals were shut down in an emergency. Major platforms in Japan posted maintenance notices one after another. Even a sushi order ran into it, with customers told the mobile mini-program was paused for a system upgrade. A cabinet official posted late at night urging everyone responsible for ops to respond immediately, and added that if a site could not be patched in time, temporarily pulling the network cable and taking it offline was still a necessary way to reduce risk.

The two flaws the security community calls PHP2Shell are tracked as CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.2.…