Hey everyone,

The PHP security team has dropped emergency security releases (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) to address two critical Remote Code Execution (RCE) vulnerabilities nicknamed PHP2Shell.

If you manage web servers running PHP, you'll want to check this immediately. Here is a quick breakdown of what's happening:

The Core Details

The Flaws: CVE-2026-109618 (out-of-memory corruption during request initialization) and CVE-2026-109619 (stale global state survival).

Severity: 9.2 (CVSS v4.0) for both.

Impact: Unauthenticated attackers can potentially achieve remote code execution, leading to complete server/site takeovers.

How it went down: Technical details and an exploit tool screenshot leaked ahead of the official drop via security firms like watchTowr and Sansec, prompting an accelerated emergency rollout.

Fixed Versions

PHP 8.5.12

PHP 8.4.27

PHP 8.3.36

PHP 8.2.35

What You Need to Do Right Now

Update immediately: Grab the latest patched version through your package manager or…