PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE on PHP servers. Attacks began before the fix.