Author: @ @Unknown
PHP2Shell Explained: CVE-2026-109618 & CVE-2026-109619
On 21 October 2026, PHP shipped emergency patches for two critical, unauthenticated remote-code-execution bugs CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 that the security community is calling PHP2Shell. One's a memory-corruption bug in how PHP handles out-of-memory errors while parsing form data; the other's a use-after-free hiding in the session upload-progress feature. Both live in PHP core itself, so your login page, your WAF, your app code none of that matters, since PHP processes the request before any of it runs.
What makes this one worse than most is the timeline: honeypots caught exploitation attempts four days before the patch even existed, and multiple security vendors confirm it's now being exploited at scale in the wild. I broke down exactly how both bugs work, what the official patch changes, and because most "PHP2Shell checkers" out there give up the moment a server hides its PHP version I built a free, open-source scanner that can still settle the hidden-version case using an active, non-destructive behavioral check. Full writeup, the patch table, and the tool are all below.