PHP releases emergency patches for two critical vulnerabilities allowing unauthenticated code execution

PHP released fixes on Oct. 21 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 severity score of 9.2 out of 10. These flaws, known as PHP2Shell, affect all PHP installations serving web requests, with the highest risk in Apache's mod_php, allowing exploitation before application code begins. The fixes are available in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Cloudflare observed attack traffic targeting customers, and security chiefs at Kraken and Ledger warned of the risks to cryptocurrency businesses, urging immediate patching and infrastructure checks beyond vulnerable websites.