Critical PHP Vulnerabilities (PHP2Shell) Pose Global Threat, Prompting Urgent Patching

Global cybersecurity agencies are urging immediate patching for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These flaws could enable unauthenticated remote code execution on vulnerable web servers, with reports indicating AI-assisted attacks and government websites going offline. Industrial vendors like Siemens, Schneider Electric, and ABB have confirmed that some of their products are affected.