Critical PHP2Shell Vulnerabilities Disclosed, Allowing Remote Code Execution

Two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed 'PHP2Shell,' have been disclosed in the PHP runtime, affecting versions 5.4 and later. These flaws enable remote code execution or data exposure through specially crafted web traffic. Cloudflare has reported observing active attack traffic against customers even before the official release of patches, underscoring the immediate threat. Organizations are advised that updating website code alone is insufficient to fully mitigate these issues.