PHP2Shell: The PHP Security Flaw That Took Websites Offline WorldwideOn Wednesday 21 October 2026, the PHP Foundation released an emergency patch for two critical flaws in PHP, the language behind roughly 70% of the world's websites. The pair, nicknamed **PHP2Shell** and tracked as CVE-2026-109618 and CVE-2026-109619, scored 9.2 out of 10 on the CVSS severity scale.Mohammed Ashraful Islam22 October 2026 · 3 min read