How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

php2shell (CVE-2026-109618 + CVE-2026-109619): unauthenticated RCE in PHP core, now detected by Escape

calendar_today October 22, 2026 person Sanjana Iyer domain escape

php2shell is a pair of critical memory-safety vulnerabilities in the PHP engine itself, tracked as CVE-2026-109618 and CVE-2026-109619. Escape detects affected PHP versions across your attack surface and shows you every exposed asset that needs the patch. php2shell is not a WordPress bug, a Drupal bug, or a bug in

open_in_new Read original post