CVE-2026-109618 & CVE-2026-109619: PHP2Shell Critical Vulnerability – what it is and what to do

The PHP project released emergency updates to address two critical "PHP2Shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. Because these flaws are already being exploited in the wild, the only complete fix is to immediately update to the latest patched versions of PHP. Dynatrace provides tools to help organizations identify affected workloads and prioritize these urgent security updates.