Major PHP CVE "php2shell"

Two major PHP CVEs (CVE-2026-109618/109619) announced a few hours ago under the name “php2shell” affects any site running PHP 5 to 8.

At the time I write this post PHP devs have been released a new update for 8.2, 8.3, 8.4 and 8.5 which patches this issue and same with Sury PHP repositories (with patches for =<8.1 versions) in case someone is using that on Debian (like me).
Cloudflare also released a WAF rule regarding this issue too but it may not be a solution to this exploit.

More info at https://php2shell.com/ and https://en.wikipedia.org/w/index.php?title=PHP2Shell