php2shell: What We Know About the Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

What happened? On October 20, a post on Hacker News claimed that two critical remote code execution (RCE) vulnerabilities in PHP – tracked by researchers as CVE-2026-109618 and CVE-2026-109619 – would be publicly disclosed on Thursday, October 22, before any patch was available.

This article has been indexed from Check Point Blog