PHP's Critical PHP2Shell Vulnerabilities (CVE-2026-109618 / 109619): A Technical Summary for Engineers [Updated Regularly]

On October 21, 2026, PHP shipped fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4 9.2) that can lead to unauthenticated remote code execution. This is a summary built around the official advisories: affected versions, how to check, interim mitigations, exploitation status, and how much of what's being reported can be trusted.