Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On October 21, 2026, the PHP project shipped emergency releases for two critical memory-safety bugs in the PHP core itself: CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell. Both are rated CVSS 9.2. Both are reachable before any application code runs, which means a “Hello World” PHP page is as exposed as a full WordPress install. And both were being probed in the wild before the fix was public.