PHP has released emergency updates to address two critical vulnerabilities that enable attackers to execute code on web servers without requiring an account. These vulnerabilities, dubbed PHP2Shell, are patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP team emphasizes that updating is the only complete solution to protect servers from these risks. The vulnerabilities are located in the PHP runtime, rendering even secure applications vulnerable. Servers using Apache's mod_php are at the highest risk since an exploit can trigger an attack before application code is executed. The vulnerabilities have been assigned CVE identifiers CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. These issues were disclosed earlier than planned due to a leak, leading to the release of patches on October 21, ahead of the initially scheduled date. Research teams from Wiz, Calif, and OpenAI discovered these vulnerabilities, which affect nearly all PHP versions back to PHP 5.4. The PHP security advisory highlights that every PHP installation serving web requests is at risk, including systems using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Updating the PHP runtime is crucial, as application updates alone do not address these vulnerabilities. PHP 8.1 and older no longer receive updates, and PHP 8.2 will reach end-of-life by December 31, 2026. The PHP security team has provided source backports for versions 7.4, 8.0, and 8.1 for those building from source or awaiting vendor updates. Some organizations have taken services offline as a precaution. Although no confirmed break-ins have been reported, Cloudflare has observed attempts to exploit these flaws and has implemented temporary firewall rules. PHP's security efforts continue as the community addresses these critical issues.