PHP Vulnerability CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): How to Patch Your Server Today
A critical PHP remote code execution vulnerability lets unauthenticated attackers run code on your server. Here is what happened, which PHP versions are affected, and exactly how to fix it. On October 21, 2026, the PHP team shipped an emergency security release for a critical PHP vulnerability affecting millions of websites: two flaws in the PHP core itself that allow remote code execution (RCE) . Both are tracked as CVE-2026-109618 and CVE-2026-109619 , both score 9.2 on CVSS v4.0 , and together they are being called PHP2Shell . If you run anything on PHP (WordPress, Laravel, Drupal, a custom app), this is a "drop what you're doing" patch. What happened Oct 20: The PHP security team pre-announced a critical release for the next day. Oct 21 (14:00 UTC): Fixed versions were released. Wiz Research reported the bugs together with Calif and OpenAI, as part of OpenAI's "Patch the planet" initiative. Cloudflare reported ea...