Author: @ @Unknown
PHP2Shell Explained: CVE-2026-109618 & CVE-2026-109619
On 21 October 2026, PHP shipped emergency patches for two critical, unauthenticated remote-code-execution bugs — CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 — that the security community is calling PHP2Shell. One's a memory-corruption bug in how PHP handles out-of-memory errors while parsing form data; the other's a use-after-free hiding in the session upload-progress feature. Both live in PHP core itself, so your login page, your WAF, your app code — none of that matters, since PHP processes the request before any of it runs.
What makes this one worse than most is the timeline: honeypots caught exploitation attempts four days before the patch even existed, and multiple security vendors confirm it's now being exploited at scale in the wild. I broke down exactly how both bugs work, what the official patch changes, and — because most "PHP2Shell checkers" out there give up the moment a server hides its PHP version — I built a free, open-source scanner that can still settle the hidden-version case using an active, non-destructive behavioral check. Full writeup, the patch table, and the tool are all below.