PHP2Shell

by ArisuYamabuki

PHP2SHELL (CVE-2026-109618 & CVE-2026-109619) ================================================ OVERVIEW PHP2Shell is the nickname given to a pair of critical, unauthenticated remote code execution (RCE) vulnerabilities in the core PHP engine. Together they affect PHP versions 5.4 through 8.5 and were estimated to impact nearly 70% of websites at the time of disclosure, since PHP powers a huge share of web servers and CMS platforms worldwide. CVE IDENTIFIERS & RATINGS CVE-2026-109618 Type: Memory corruption via out-of-memory (OOM) handling CVSS v4.0: 9.2 CVSS v3.x: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Added to CISA's Known Exploited Vulnerabilities catalog (Oct 26, 2026) CVE-2026-109619 Type: Use-after-free (UAF) via stale global state CVSS v4.0: 9.2 CVSS v3.x: 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) AFFECTED VERSIONS PHP 5.4 through 8.5 (all actively used branches at…