TL;DR: PHP2Shell ( CVE-2026-109618 , CVE-2026-109619 ) is a pair of critical remote code execution flaws in the PHP core (CVSS 9.2). In lab testing, the issue is not a narrow “one-off bug” — under the right conditions it can be driven from a simple code-execution check all the way to a reverse shell. Patch now. There is no complete mitigation other than updating. ⚠ Security notice: This post is for defensive awareness only. All demos were run in an isolated lab against a local containerized target. Do not probe systems you do not own. Watch the lab demo I recorded a short proof-of-concept walkthrough (English captions, lab-only): ▶ PHP2Shell RCE PoC — From Fatal Error to Reverse Shell https://www.youtube.com/watch?v=1D9i6-tUxaI Demo intro: patch immediately · isolated lab only What is PHP2Shell? On 21 October 2026 , the PHP project published a security advisory for two critical RCE vulnerabilities nicknamed PHP2Shell...