PHP2Shell: two critical flaws in PHP's core let attackers take over web servers without a password
On October 21, PHP shipped emergency fixes for CVE-2026-109618 and CVE-2026-109619, two remote code execution flaws in the interpreter itself that aff...