Key point: The NSA and CISA have urged immediate patches for two critical PHP vulnerabilities. Here are six questions to guide your discussion with IT.
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,” can permit unauthenticated remote code execution on affected systems. Exploitation attempts were reported even before the patch was
