PHP2Shell Explained: Patch the Critical PHP RCE Flaws Now
Two critical vulnerabilities in the PHP runtime can allow an unauthenticated attacker to execute code on an affected server. The issues are being called PHP2Shell and are tracked as CVE-2026-109618 and CVE-2026-109619.
This is not a WordPress plugin bug and it is not fixed by updating WordPress, Laravel, Drupal, Joomla, or Magento. The vulnerable component is PHP itself. If a public website or API processes requests with PHP, verify the runtime and patch it now.