Critical Remote Code Execution Vulnerabilities (PHP2Shell) Patched in Emergency PHP Release

The PHP development team has released emergency security updates to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively dubbed 'PHP2Shell.' Rated with a CVSSv4.0 score of 9.2, these flaws could allow unauthenticated attackers to execute code on web servers. Patches are available for supported PHP 8.x branches (8.5.12, 8.4.27, 8.3.36, and 8.2.35), and organizations are urged to update immediately or isolate affected internet-facing applications.