Critical PHP2Shell Vulnerabilities Lead to 'Black October' with Widespread Exploitation Risk

Two critical security vulnerabilities in PHP, CVE-2026-109619 and CVE-2026-109618, collectively known as PHP2Shell, were patched on October 21, 2026. Rated 9.2 on CVSS, these flaws allow unauthenticated attackers to execute arbitrary code and steal data. The rapid dissemination of AI-based exploit code has led some organizations to take websites offline, earning the episode the name 'Black October'. The vulnerabilities impact all PHP versions from 5.4 to 8.5.