What two critical PHP vulnerabilities teach us about SBOMs, containers, DevSecOps, and automated security patching.

In application security, we often focus our efforts on source code analysis, dependency management, and API protection.

But what happens when the vulnerability exists in the runtime responsible for executing the application itself?

On October 21, 2026, the PHP project released emergency security updates addressing two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 , collectively known as PHP2Shell .

Both received a CVSS v4.0 score of 9.2 and may allow unauthenticated remote code execution (RCE), depending on the conditions required for exploitation.

This incident highlights an important security challenge: an application can have secure code and still be vulnerable because of the infrastructure running it.

1.…