The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.

Admins should install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible on servers running PHP 8.x and migrate to a fixed release if they're running PHP 7 or earlier. 

To fully mitigate against these vulnerabilities, remediation will depend on the platform and may require upgrading PHP and/or the underlying OS. This may require application testing and validation to ensure functionality post-upgrade. If immediate patching is not feasible, application owners must be prepared to implement temporary risk mitigation measures, including restricting access, limiting exposure, or temporarily taking affected applications or services offline until the necessary security updates can be applied. Internet-facing applications should receive the highest priority, and any delays in remediation should be promptly communicated to Information Security to assess potential risks and coordinate appropriate interim safeguards.