PHP2Shell: CVE-2026-109618 and CVE-2026-109619 critical PHP RCE flaws leaked before scheduled patch release
Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (dubbed PHP2Shell), were leaked ahead of the coordinated disclosure and patch release planned for October 21 at 2pm GMT. A Hacker News forum user, petecooper, posted the CVE identifiers on October 20, claiming a CVSS score of 10.0 and a disclosure …