Critical PHP Vulnerabilities (PHP2Shell) Actively Exploited, Affecting 70% of Websites

Two critical remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, have been disclosed in PHP, the programming language powering an estimated 70% of websites worldwide. Emergency patches were released on October 21, 2026, after technical details leaked, leading to widespread exploitation attempts observed by Cloudflare.