PHP2Shell Vulnerabilities (CVE-2026-109618 & CVE-2026-109619): Analysis and Remediation

TL;DR: Critical PHP remote code execution vulnerabilities The PHP project released fixes on October 21, 2026, for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 on CVSS v4.0 and can allow unauthenticated Remote Code Execution (RCE) . These vulnerabilities are memory corruption bugs in PHP’s underlying C runtime code, not in the web applications running on it, so the only complete fix is deploying a patched PHP binary build.