Two critical PHP vulnerabilities were disclosed on October 21, 2026. If you maintain a PHP application, here's how to check your runtime, patch safely, and avoid turning an urgent security update into a production incident.

The PHP team has released security updates for two vulnerabilities that can allow unauthenticated remote code execution on affected systems.

The vulnerabilities are:

CVE-2026-109618

CVE-2026-109619

Both have a CVSS v4.0 score of 9.2 and have been associated with the name PHP2Shell.

The official PHP advisory is here: https://www.php.net/archive/2026.php

The key takeaway is straightforward: identify every affected PHP deployment and apply the appropriate security update immediately.

The more complicated part is making sure the fix reaches the PHP runtime actually serving production traffic.

Which PHP versions are affected?

The PHP project has published the following fixed releases:

PHP 8.1 and earlier are no longer supported upstream.…