Yesterday, two critical vulnerabilities were disclosed in PHP, the scripting language used by many websites and online services: CVE-2026-109618 and CVE-2026-109619 . Attackers can exploit them to remotely execute commands on any server running PHP, with no authentication required. The exploit has been dubbed PHP2Shell. The PHP security team announced an upcoming emergency update on October 20 and released patches fixing the vulnerabilities the following day. We’ve already covered the technical details of these vulnerabilities and explained what companies and server administrators should do . You may have safely skipped that news because you don’t run any servers — but unfortunately, the issue is not limited to businesses. Nearly 70% of websites run on PHP, including services we use every…