Two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed ‘PHP2Shell,’ have been disclosed in PHP, a widely used scripting language for web servers. These flaws allow unauthenticated attackers to execute arbitrary code on affected systems. Exploitation attempts have been observed in the wild, with some targeting Mirai botnet deployment. Organizations are urged to patch immediately, as the vulnerabilities affect a significant portion of web infrastructure.