PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation | Datadog Security Labs

On October 21, 2026, PHP released security updates for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both have a Common Vulnerability Scoring System (CVSS) v4.0 score of 9.2.