Patch PHP now: the “php2shell” flaws are under active attack
Two remote code execution bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619, are on CISA’s list of exploited vulnerabilities. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP.