On 21 October 2026, the PHP development team released security updates addressing two critical vulnerabilities that could allow attackers to execute code on affected web servers without authentication.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 , have been grouped under the name PHP2Shell . Both carry a CVSS 4.0 severity score of 9.2 out of 10.

This is not simply another reminder to keep WordPress plugins updated. The underlying problems exist in PHP itself, the runtime that processes requests and executes application code on the server.

That distinction matters.…