PHP2Shell (CVE-2026-109618 and CVE-2026-109619): detecting unauthenticated remote code execution in the PHP core

The PHP project released an emergency version on October 21 to fix two unauthenticated remote code execution vulnerabilities in the PHP core, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2); attackers can execute code on the server with only an HTTP request. The two CVEs group four memory safety flaws; the common root cause is that a PHP worker, after a fatal out-of-memory error, does not clean up a global pointer pointing to the request heap, and subsequent requests use a stale pointer to freed memory; the affected code dates back to PHP 5.4 in 2012, and the flaw is at the engine layer, so exposure cannot be avoided even if application code is clean. The researcher who reported the vulnerabilities says AI models participated in vulnerability discovery and exploit development; Amazon honeypots had already seen attempts on October 17, and Cloudflare reported early attacks on October 21 at 07:43 UTC, more than six hours before the fix was released.