Recent critical PHP vulnerabilities disclosed in October 2026, including the high-severity PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) enabling unauthenticated remote code execution, were patched on October 21 with updates to versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA added both to its Known Exploited Vulnerabilities catalog on October 26 amid confirmed exploitation attempts, prompting immediate patching across internet-facing servers. With only two months remaining in the year and major issues addressed, traders see limited scope for another comparable critical flaw before year-end. A separate lower-impact advisory on CVE-2026-115560 further signals active monitoring rather than an impending new crisis.