Reference: CDNetwork Cloud Security Last updated on October 22, 2026 On October 21, 2026, two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, CVE-2026-109618 and CVE-2026-109619 (collectively dubbed “php2shell”), were disclosed. Both score 9.2 on CVSS v4.0 and could let unauthenticated attackers execute arbitrary code, access sensitive data, or disrupt services. What’s affected The flaws are memory-handling bugs in PHP itself, so any PHP-based si

Reference: October 21, 2026by Akamai Security Intelligence Group On October 21, 2026, PHP released a security advisory remedying two severe security flaws, each carrying a CVSS v4.0 rating of 9.2. CVE-2026-109618 CVE-2026-109619 The patches are available immediately and users are urged to upgrade to fixed releases as soon as possible. Mitigation with Akamai App & API Protector Akamai App & API Protector customers are protected because we have released security updates to a