The PHP project released emergency updates on Oct. 21, 2026, for two critical flaws in the PHP runtime that can allow unauthenticated remote code execution. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix the bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and known among researchers as php2shell, and the project’s security advisory says all PHP users are strongly encouraged to update immediately.

The advisory puts every PHP installation that serves web requests at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team said it considers the risk highest for mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs. Both flaws involve memory handling after an error.…