PHP2Shell: The Patch Is Out. Is It Running in Your Containers?

The PHP project released fixes on October 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. These vulnerabilities allow unauthenticated attackers to take over web servers via crafted requests. While emergency releases are available for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, no patches will be provided for PHP 7.4, 8.0, or 8.1. CISA and CERT-EU issued alerts as exploit attempts were detected by Amazon honeypots.