PHP2Shell: what to do today if your sites run PHP (CVE-2026-109618/109619)

PHP2Shell is the nickname for two critical PHP flaws disclosed on 21 October 2026: CVE-2026-109618 and CVE-2026-109619. Together they can let an unauthenticated attacker run code on a server that runs