PHP security is currently in a post-crisis patching phase following the discovery of two critical vulnerabilities, collectively known as PHP2Shell, which were disclosed in late October 2026. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, reside in PHP’s memory management and error handling systems, affecting nearly every web request on servers running the language since PHP
