PHP2Shell Exploit: The Aftermath — What We Learned After the Emergency Patch (2026)
The Wednesday panic, briefly recapped On 21 October 2026, the PHP project shipped an emergency security release for two critical flaws in the PHP interpreter itself — the PHP2Shell exploit, as researchers nicknamed it. The flaws are CVE-2026-109618 (RCE via out-of-memory corruption, advisory GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (RCE via stale global state, advisory GHSA-6wmf-4rv5-p3rp), both rated … Read more