[security Advisory] Critical PHP Remote Code Execution Vulnerabilities ("php2shell") — All Our Systems Have Been Patched Dear customers, PHP released an emergency security update on October 21, 2026, fixing two unauthenticated remote code execution vulnerabilities (CVSS 9.2): CVE-2026-109618: Attackers can send a crafted multipart POST ...