The main case

The PHP2Shell patches shipped on October 21: two vulnerabilities in the core of the language, CVE-2026-109618 and CVE-2026-109619, CVSS 9.2 (Source: helpnetsecurity.com).

They allow unauthenticated remote code execution, meaning someone outside can run whatever they want on the server without an account or a password.

The flaw is fixed in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

What stands out is the timeline.

AWS detected exploitation attempts from October 17, four days before the patch existed (Source: helpnetsecurity.com).

And it reaches further than it looks. WordPress, Magento, Drupal or Nextcloud can be exposed even when their own code is clean, because the flaw lives in the interpreter that runs them.

The second case arrived almost at the same time.…