rce

PHP2Shell (CVE-2026-109618 and CVE-2026-109619): what to do now about your PHP

Two critical flaws in the PHP core allow unauthenticated RCE and memory disclosure. Fixed versions, mitigations, secret rotation and an ordered checklist.

php2shell: how LFI, upload and filter chains turn into RCE in PHP

Defensive guide to php2shell: how LFI, insecure upload, phar and PHP filter chains turn into RCE, real CVEs and public tools to validate and fix.