On October 21, 2026, the PHP development team released emergency security updates for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell. Both flaws could allow unauthenticated attackers to execute arbitrary code on vulnerable servers. Researchers observed scanning and exploitation attempts before the official disclosure and patch release, highlighting how quickly attackers can act when details of a critical vulnerability become available. The vulnerabilities affect PHP’s core request-handling processes and stem from use-after-free memory errors. Successful exploitation could give attackers remote code execution without requiring valid credentials, potentially enabling them to compromise web servers, access sensitive information or establish a foothold for further attacks. The flaws affect multiple PHP configurations, including PHP-FPM, Apache with mod_php and php-cgi. On October 26, the US Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities catalogue, reflecting evidence of exploitation in the wild. Organisations should immediately identify exposed PHP installations and upgrade to fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply vendor-provided backported fixes. Security teams should also check third-party applications, containers and appliances that bundle PHP, as these components may require separate updates. Where patches cannot be applied promptly, organisations should assess whether vulnerable services need to be isolated from public access and review web server, application and endpoint logs for suspicious activity. The combination of unauthenticated remote code execution and confirmed exploitation makes rapid remediation essential.