PHP2Shell: Two Dormant Bugs Just Put 70% of the Web at Risk

Two dormant PHP flaws, CVE-2026-109618 and CVE-2026-109619, enabled passwordless remote code execution across 70% of the web. Patches landed Wednesday; active exploits already confirmed.