PHP2Shell: Two Critical RCE Flaws Patched in PHP (CVE-2026-109618 & CVE-2026-109619)
On 21 October 2026, the PHP security team shipped patches for two critical remote code execution vulnerabilities, collectively dubbed PHP2Shell by the researcher who found the exploit chain, Kirill Firsov. Both flaws carry a CVSSv4.0 score of 9.2. Both are exploitable before any application code runs, with no authentication required. If your server runs PHP to handle web requests — and it almost certainly does — patch now. What is actually broken CVE-2026-109618 — OOM Corruption ...