PHP ships emergency fixes for two critical unauthenticated RCE flaws, PHP2Shell

On October 21, 2026, the PHP project shipped emergency fixes for CVE-2026-109618 and CVE-2026-109619, two critical flaws allowing unauthenticated remote code execution. Agencies in Europe, Australia, Japan, Britain and the U.S. NSA urged users to update immediately or take sites offline. Government websites went offline after AI found the flaws. Aikido Security says the flaws are being exploited.