PHP2Shell: Why Kenya’s PHP-Dependent Web Needs to Move Faster than the Attackers

By Allan Juma, Lead Cybersecurity Engineer at ESETOn 21 October, the PHP project released emergency fixes for two critical flaws in the PHP engine. Tracked as CVE-2026-109618 and CVE-2026-109619 and now widely referred to as PHP2Shell, the flaws allow unauthenticated remote code execution and can impact all PHP installations serving web requests.