On 21 October, PHP shipped emergency releases for PHP2Shell : CVE-2026-109618 and CVE-2026-109619 . Unauthenticated remote code execution, every branch from 5.4 to 8.5.11, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA added both to its exploited list on 26 October. AWS saw attempts four days before disclosure.

Look at where it breaks:

CVE-2026-109618 is in the engine's hash table. A crafted POST pushes a key allocation over memory_limit , the fatal error leaves a half-built entry in $_POST , and shutdown cleanup trusts it.

CVE-2026-109619 is a use-after-free: state that survives one request is read by the next one on the same worker.

The first one fires while PHP is still parsing the request. Your first line of code has not run yet. Your input validation, your framework, your dependencies, your careful code review: none of it is on the path. The second needs little more from you than PHP's default upload-progress setting.…