Huntress Rapid Response: Leaked PHP RCE Flaws CVE-2026-109618 and CVE-2026-109619 (php2shell) Ahead of Patch Release
Huntress published a rapid-response advisory on two leaked critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, informally named "php2shell". Both are rated CVSS v4.0 9.2 and are publicly described as remote code execution. The details leaked via a removed Hacker News post, and watchTowr confirmed they are real. The PHP…