Bitdefender technical advisory: PHP2Shell pre-authentication remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Bitdefender published a technical advisory detailing two pre-authentication remote code execution vulnerabilities in PHP, PHP2Shell (CVE-2026-109618, CVE-2026-109619). All unpatched PHP installations that handle web requests are affected, with Apache mod_php at highest risk. Both vulnerabilities have a CVSS v4.0 score of 9.2 and are memory corruption flaws in PHP worker processes; the advisory assesses them as runtime flaws rather than application flaws, and on mod_php, updating the CMS or hardening the application does not change the exposure surface. PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 2026-10-21; the 7.4, 8.0, 8.1 and earlier branches have no official fix, and PHP says updating is the only safe option.