On October 21, patches were released for two dangerous vulnerabilities in the PHP core (CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell). They allow an attacker to execute arbitrary code on a server without authentication. PHP powers a huge share of websites on the internet, so a great deal is at risk. Exploitation is already being ...