PHP2Shell (CVE-2026-109618 and CVE-2026-109619): is your website affected, and how to fix it

Two critical PHP flaws let attackers run code on a web server without logging in. Which sites are affected, the fixed PHP versions, how to check yours on shared hosting, WordPress, VPS or Docker, and why the popular workaround isn't enough.