CVE-2026-109618 / CVE-2026-109619 | What is Known
// summary
Two PHP core flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution and are addressed in October 2026 security updates.
// from the source
PHP2Shell refers to two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can enable unauthenticated remote code execution. Explore the out-of-memory corruption and stale global state attack paths, affected PHP versions, exploitation conditions, and October 2026 security updates.