PHP2Shell: Critical PHP RCEs and How to Respond
A pair of critical PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Bloo runs no PHP anywhere in its stack, so it is not affected. Here is what happened, the exposure, and what to do next.
Siddharth Singh
