php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

Update October 21: PHP released patches and published its advisories. This post now includes vulnerability details, fixed versions, source backports for end-of-life branches, interim mitigation guidance, updated exploitation details and Tenable product coverage. October 21: Original publication based on limited public information ahead of PHP's official advisory.