TechnologyPHP News: Two Critical PHP2Shell Flaws Are Fixed. Here Is What to Do for Your Setup
The biggest PHP news this week is PHP2Shell: two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can let attackers run code on web servers without logging in. PHP fixed them on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating is the only complete fix; versions 8.1 and older have no official release.
