PHP2Shell: Two critical PHP vulnerabilities can lead to unauthenticated remote code execution

The PHP development team released an emergency security update on October 21, fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0 (collectively called PHP2Shell), which allow unauthenticated attackers to execute code with the privileges of the affected PHP worker process. Affected deployments include Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, with Apache mod_php listed as the highest-risk configuration; the official fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to OpenAI, the two vulnerabilities were discovered and verified by researchers participating in its Patch the Planet project using frontier models combined with expert human review.