'PHP2Shell' Bugs Signal Red Alert for Security Industry

A leaked pair of severe PHP vulnerabilities, nicknamed 'php2shell' by researchers, is causing alarm across the security community. CVE-2026-109618 allows remote code execution through out-of-memory corruption, while CVE-2026-109619 achieves RCE via stale global state; both carry a CVSS v4.0 score of 9.2 and were found by consulting firm Calif. WatchTowr says the flaws require no authentication and can be triggered simply by reaching a server over the network, with Session Upload Progress—enabled by default in many deployments—offering a confirmed attack path, and the firm has already detected exploitation attempts in the wild, particularly against PHP run as an Apache module. The PHP Foundation's planned coordinated release was disrupted when details and a proof-of-concept tool leaked ahead of schedule, pushing organizations to urgently patch to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, since unsupported older versions have no official fix.