PHP2Shell: the expiry date on “too hard to exploit”
On 21 October 2026, PHP shipped emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are CVSS v4.0 9.2. What matters: The flaws are in the PHP interpreter, not in any application. A fully patched WordPress and a ten-line “Hello World” are equally exposed if the PHP...