rce

PHP2Shell: Two Bugs in PHP Core That Fire Before Your Code Runs

CVE-2026-109618 and CVE-2026-109619 give an unauthenticated HTTP request two independent paths to code execution inside the PHP core itself, both reached while PHP parses the request rather than inside your application; what follows is the exposure matrix, the exploitation record so far, and the checklist for the days before you can patch.