PHP2Shell Vulnerabilities: What Happened, Who Is Affected and How to Respond
On 21 October 2026, two critical vulnerabilities in PHP, known collectively as PHP2Shell, prompted urgent security warnings from the UK’s National Cyber Security Centre (NCSC) and other cybersecurity authorities. Tracked as CVE-2026-109168 and CVE-2026-109619, both vulnerabilities carry a CVSS v4.0 score of 9.2 and could allow unauthenticated attackers to execute malicious code remotely on vulnerable PHP servers.