PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been exploited in the wild.