PHP2Shell (CVE-2026-109618/109619): two RCEs in PHP itself. Unauthenticated attackers can run code before any app code runs.
Patched: 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 8.1 and older: no fix from the PHP project, ask your distro.
Can't update today? Free, tentative CrowdSec WAF virtual patches:
CVE-2026-109618: https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2026-109618
CVE-2026-109619: https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2026-109619
A stopgap, not a fix.