PHP2Shell Explained: The AI-Found Bug in 70% of Websites — and What to Do About It
In brief On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities in the PHP language itself, collectively called PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated remote code execution — an attacker with no account can run code on the server. The flaws sit in PHP’s core engine, not in … Read more