PHP2Shell: two critical RCEs shipped in PHP since 5.4 force an immediate engine patch

On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws that have lived in PHP since 5.4. They affect 70% of websites, including WordPress, Drupal and Joomla: update the PHP engine, not just your applications.