Emergency Security Fix Released for Critical PHP Remote Code Execution Vulnerabilities

The PHP team has issued an emergency security release to address two critical Remote Code Execution (RCE) vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. These flaws, collectively dubbed 'php2shell,' carry a CVSS v4.0 score of 9.2. The patches were scheduled for release on October 21, 2026, at 14:00 UTC. Reports indicate that details of the vulnerabilities may have been leaked prior to the official patch, and Cloudflare has observed early attacks exploiting these critical flaws. All PHP users are strongly advised to update their installations immediately to mitigate potential risks.