How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →

PHP2Shell: What CVE-2026-109618 and CVE-2026-109619 Mean for Security Teams

calendar_today October 24, 2026 person David Allen domain brinqa

On October 21, 2026, the PHP project released emergency security updates for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Researchers call the pair PHP2Shell. Both are rated 9.2 under CVSS v4.0, and both sit in the PHP runtime itself, s

open_in_new Read original post

Discovery

Learnings

Guidance

Toolbox

Alignment

API Evangelist LLC

PHP2Shell: What CVE-2026-109618 and CVE-2026-109619 Mean for Security Teams