[Urgent Notice] CVE-2026-109618 / CVE-2026-109619 (CVSS 9.2) PHP2Shell – Critical PHP RCE Vulnerability

Overview

---

Two remote code execution (RCE) vulnerabilities (vulnerabilities that allow a threat actor to execute arbitrary code remotely) have been identified in PHP. These vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619, and have each been reported with a CVSS score of 9.2 And a severity rating of “Critical.”

Impact

---

It has been reported that a threat actor who successfully exploits these vulnerabilities can perform arbitrary code execution on a vulnerable PHP server.

Affected Products

---

The affected product is PHP; as of October 21, no official scope of impact has been provided.

Remediation Information

---

The Vulnerability Patch is scheduled to be released on October 21, 2026, at 11:00 PM. As soon as the official security update is released, you must update to the latest version corresponding to your PHP distribution.