TL;DR

what: PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP runtime collectively named PHP2Shell, a day after details leaked ahead of planned disclosure.

impact: An unauthenticated attacker can achieve remote code execution, with a single-request exploit demonstrated on Apache mod_php, and can read worker memory holding passwords, tokens, API keys and certificates from other requests.

fix: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both flaws, source backports exist for 7.4, 8.0 and 8.1, and the PHP team states that only updating fully protects a server.

who: Every PHP installation serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, regardless of how secure the application code is.

PHP has shipped emergency updates for two critical flaws in the language runtime that let an attacker with no account execute code on a web server.…