PHP2Shell CVE-2026-109618: Patch Now, Catch the Next One

PHP2Shell (CVE-2026-109618, CVE-2026-109619) and a third unpatched PHP issue landed in one week. What to patch now, and how to stop the next one reaching production.