Today at 14:00 UTC, the PHP project shipped emergency security releases (8.5.12, 8.4.27, 8.3.36, and 8.2.35) to fix 2 critical vulnerabilities in the core PHP engine: CVE-2026-109618 and CVE-2026-109619. Collectively tracked as PHP2Shell and rated 9.2 under CVSS v4.0 by the PHP security team (and a straight 10.0 by several independent researchers), the bugs allow an unauthenticated attacker over the open internet to leak live server memory and execute arbitrary shell commands on standard PHP deployments.