PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

PHP's security team is pushing out an unscheduled release at 14:00 UTC on October 21 to fix two critical remote-code-execution bugs it rates 9.2 on CVSS v4.0, without yet detailing how they work. The patch will only reach the four currently supported branches, 8.2 through 8.5, while older versions such as 8.1, 8.0, 7.x and 5.x stay unprotected since they're end of life. The fix was accelerated after a leak surfaced on Hacker News naming CVE-2026-109618 and CVE-2026-109619 with a claimed CVSS 10.0 score and alleging every version since PHP 5 is vulnerable — a scope watchTowr says remains unconfirmed by any official advisory. Researchers have nicknamed the pair "php2shell"; so far neither PHP, Huntress nor watchTowr have observed active exploitation, though security firm Mallory estimates roughly 884,000 internet-facing hosts still run PHP 8.1 or earlier and could be exposed once technical details emerge.