Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet

On October 21st, 2026 , the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the vulnerability details and began testing the patch...