Critical9.2VulnerabilityActiveExploitedPatch availableEPSS 100%CVE-2026-109618CVE-2026-109619· updated Nov 6
PHP2Shell: Two Unauthenticated Remote Code Execution Vulnerabilities in PHP (CVSS 9.2); MODA Estimates ~28,000 Websites Affected in Taiwan
On October 21, PHP released security updates patching CVE-2026-109618 and CVE-2026-109619, two vulnerabilities with CVSS v4.