PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Vulnerability Analysis, Impact Assessment, and a Practical Mitigation Framework for Web Server Operators

On 21 October 2026 the PHP project released emergency fixes for two critical flaws in the PHP interpreter, collectively known as PHP2Shell. Both carry a CVSS v4.0 score of 9.2 and can allow unauthenticated remote code execution on servers that handle web requests. Details leaked before coordinated disclosure, exploitation was observed before the patch, and governments across Europe took public websites offline as a precaution. This technical note synthesises the public advisories and vendor research into a single reference. It explains the two root causes, quantifies exposure using published telemetry, and organises vendor guidance into a five-stage framework: inventory, patching, interim mitigation, compromise assessment and long-term hardening. It closes by discussing the role of artificial intelligence (AI) in both the discovery of these flaws and the speed of their exploitation, and proposes an anomaly-detection approach for identifying exploitation attempts from server telemetry as future work.