PHP Issues Emergency Patches for Critical Remote Code Execution Vulnerabilities (PHP2Shell)

The PHP development team has released emergency security updates (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These flaws could allow unauthenticated attackers to execute code on web servers, with immediate patching strongly recommended for all PHP installations serving web requests. The patches were released around 14:00 UTC on October 21, 2026.