On October 28, 2026, CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog: an uninitialized variable in the Linux kernel’s ESP-in-TCP path that chains with the two PHP2Shell flaws to plant webshells and run commands as root. The remediation deadline is October 31: patch the kernel and hunt for webshells on exposed PHP servers.

On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws that have lived in PHP since 5.4. They affect 70% of websites, including WordPress, Drupal and Joomla: update the PHP engine, not just your applications.