PHP2Shell Shakes Core PHP Runtime: Dual CVSS 9.2 Vulnerabilities Enable Unauthenticated RCE
software••2 min•php.net
The PHP core security team released emergency out-of-band updates addressing two critical memory management flaws (CVE-2026-109618 & CVE-2026-109619) dubbed PHP2Shell. The vulnerabilities exploit the C-level Zend Engine before application code executes, prompting urgent infrastructure patching across global web servers.