PHP2Shell is two critical PHP bugs disclosed on October 21, 2026: CVE-2026-109618 (remote code execution via out-of-memory corruption) and CVE-2026-109619 (remote code execution via stale global state). Both are CVSS 4.0 9.2 and need no authentication. Attacks are already happening.

Upstream fixed only PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 . Everything else depends on your vendor.

The version-number trap

Most people check with php -v . On a patched Ubuntu 24.04 that still prints PHP 8.3.6 , because Ubuntu backported the fix into its own package ( 8.3.6-0ubuntu0.24.04.13 ). Debian, RHEL, AlmaLinux, Rocky, Remi and others do the same in different ways.…