
CyberClan Security Brief: Critical PHP “PHP2Shell” Vulnerabilities Require Immediate Attention
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution on web servers running PHP. Severity: Critical (CVSS 9.2) Two vulnerabilities in the core PHP engine can let an attacker run code on a web server without logging in. Patches are available. Organizations running PHP should update immediately. Executive Summary On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities, collectively known as “PHP2Shell”. Both flaws sit in the PHP engine itself,

