Your login page can be flawless. Your WordPress plugins can be current. Your application can validate every input. And an attacker may still reach a critical vulnerability before your PHP code runs. On October 21, 2026 , the PHP Security Team shipped emergency fixes for two critical vulnerabilities known collectively as PHP2Shell : CVE-2026-109618 — remote code execution (RCE) through out-of-memory corruption during PHP request handling. CVE-2026-109619 — RCE through stale g...