On 21 October 2026, the PHP project released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 , now known as PHP2Shell . They let an attacker run commands on a web server with a single crafted request, without an account and without touching your site's own code. If your website, shop or admin panel runs on PHP, and that includes most WordPress, WooCommerce, Laravel, Drupal and Magento sites, this is worth ten minutes of your time today. Shor...