On 21 October 2026, the PHP project issued emergency fixes for php2shell, two critical vulnerabilities in the core of the engine, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution across every web serving mode. The unsupported branches, from PHP 5 to PHP 8.1, are listed as affected by CERT-FR but absent from the CVE records, and receive no fixed release.
