**US government agencies including CISA, NSA, and FBI issued urgent guidance on October 21 urging immediate patching of the two critical PHP core remote code execution flaws (CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell) that affect versions 5.4 through 8.5.** The vulnerabilities, discovered earlier via AI-assisted research by Calif and Wiz, leaked on October 20 ahead of the planned disclosure, prompting PHP to ship fixes in 8.5.12, 8.4.27, 8.3.36, and 8.2.35 the next day. Private security firms reported early exploitation attempts and in-the-wild activity targeting session upload progress paths, while CISA stated it had not observed exploitation as of its advisory. The White House coordinated with agencies and AI firms on the response. Trader focus centers on whether official US confirmation of specific exploitation or attribution emerges amid ongoing monitoring and the rapid shift from leak to patch.