Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAF

The global threat landscape shifted dramatically today following the disclosure of PHP2Shell, a pair of critical Remote Code Execution (RCE) vulnerabilities tracked as CVE-2026-109618 (OOM memory corruption) and CVE-2026-109619 (stale global state). Both carry a CVSS score of 9.2 and affect core memory handling across decades of PHP releases. Because PHP powers a vast portion … Continued The post Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAF appeared first on VMware Blogs .