PHP2Shell Is a PHP Remote Code Execution Bug Whose Official Workaround Doesn't Work
PHP2Shell, a pair of unauthenticated php remote code execution flaws in PHP's core, leaked online a day ahead of its planned disclosure, and PHP's own security team has confirmed that the interim workaround circulating since the leak doesn't actually close both bugs. CVE-2026-109618 and CVE-2026-109619 affect essentially every way PHP serves a web request, and emergency patches shipped October 21, 2026, after watchTowr and Cloudflare both reported active exploitation attempts before the fix was
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.