PHP2Shell Exposed: The Critical 9.2 RCE Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) and Why WordPress Updates Will Not Save You

Over the past 48 hours, mainstream global news outlets, cybersecurity emergency response teams (CERTs), Canonical, and the National Security Agency (NSA) have issued urgent security directives regardi