How we handled PHP2Shell, and what testing the exploit taught us
On 20th October 2026, details of two critical PHP vulnerabilities leaked online before a fix was available. Tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, both are rated 9.2 on CVSS v4.0 and allow unauthenticated remote code execution. As the flaws were in the PHP engine and not in the application code, every PHP installation
