This blog was originally published by Jason Taylor on the Raxis blog October 21, 2026 Two separate threats hit PHP websites this week, and each needs its own fix. On October 21, the PHP project released emergency patches for two remote code execution flaws in the PHP runtime, nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4.0 score of 9.2 and let an unauthenticated attacker run code on a web server. Because the bugs live in PHP itself, a site can b...