PHP2Shell: Inside Two Critical PHP Core Vulnerabilities That Enable Unauthenticated RCE

Understanding CVE-2026-109618 and CVE-2026-109619, the memory-management failures behind them, and what defenders should do now. On October 21, 2026, the PHP development team disclosed two critical vu