Patching PHP2Shell Across a Dockerized Infrastructure
With the PHP security team releasing emergency patches on October 21, 2026 for two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), the request to update was immediate. Both flaws, collectively referred to as PHP2Shell, allow an unauthenticated attacker to execute code on any PHP installation serving web requests. The CVSS score is 9.2, and the PHP team’s guidance was clear: there are no complete mitigations, updating is the only safe choice.
Continue reading