Security9 min read
PHP2Shell: Inside CVE-2026-109618 and CVE-2026-109619, the Critical Unauthenticated RCE in Core PHP
Two critical, unauthenticated remote code execution flaws in the PHP engine itself — not in your application code. What triggers them, who's exposed, how to check, and exactly how to patch.