Hello, I'm Maneshwar, and I'm building LiveReview — a blast-radius aware AI code review built for your business-critical systems. Star us to help devs discover the project, give it a try, and share your feedback to help improve the product.

Imagine you do everything right.

You validate your inputs. You use prepared statements. You escape your output. You have a linter, a code review process, and a slightly smug Slack channel called #security-wins.

Then someone sends your server one weird HTTP request, and it runs their code instead of yours.

Not because of anything you wrote.

Because of something PHP did while cleaning up after itself.

On October 21, 2026, the PHP project shipped a security release for two critical bugs, CVE-2026-109618 and CVE-2026-109619 .

The internet has already nicknamed the pair PHP2Shell , which is a great name and a terrible Wednesday.

Let's walk through what actually broke, why it is a bigger deal than "yet another CVE", and also where the scary headlines are a little ahead…