PHP2Shell is a pair of critical remote code execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2). The PHP project released the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 at 14:00 UTC. Over the following days, I had Claude Opus 5.5, track 33 vendors that ship PHP to see when each one had a patched package available. The vendors include Linux distributions, BSDs, third-party repositories, Windows package managers, hosting panels, container images and NAS firmware.