PHP2Shell: Critical RCE Vulnerabilities in PHP Core

Title: PHP2Shell: Two Critical RCE Vulnerabilities in PHP Core

Summary: The PHP Group shipped an emergency security release on October 21, 2026 fixing two critical PHP-core remote code execution flaws — CVE-2026-109618 and CVE-2026-109619, tracked as “PHP2Shell” and rated 9.2 under CVSS v4. One stems from out-of-memory handling that can leave request memory partially uninitialized; the other leaves global state pointing at freed memory regions that later requests can read or branch on — both paths end in unauthenticated RCE on exposed installs. Researchers counted more than 22.6 million potentially vulnerable instances, and the flaws are already being exploited in the wild, including chains with a Linux kernel privilege-escalation bug to gain root on internet-exposed management interfaces. CISA is urging organizations to patch immediately.

References:

• CISA alert: Critical Vulnerabilities in PHP Require Immediate Patching
• Unit 42 threat brief: CVE-2026-109618 / CVE-2026-109619
• Google Cloud: responding to the core PHP vulnerabilities