vulnerability

October 23, 2026 | 15 min

PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Security Report and Response Plan

A security report on PHP2Shell, the two critical PHP engine flaws fixed on 21 October 2026: what they are, who is most at risk, which versions are fixed, what HKCERT, Singapore's CSA and CISA advise, and a 24-hour, 72-hour and 7-day response plan for businesses in Hong Kong, China and Singapore.