The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]
PHP ships emergency patches for critical PHP2Shell flaws
Summary + source link. No paywalls, no tracking.