On October 20–21, 2026, two critical unauthenticated Remote Code Execution (RCE) vulnerabilities in the PHP runtime—collectively tracked as PHP2Shell ( CVE-2026-109618 and CVE-2026-109619 , CVSS v4.0 9.2 )—were publicly disclosed alongside emergency upstream patches ( PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 ).

Because both vulnerabilities reside in PHP's core request lifecycle and rfc1867 multipart upload handling rather than application-layer code, standard application-level auth checks, CSRF tokens, and routing middleware do not block exploitation . Worse, on persistent worker SAPIs like Apache mod_php , exploitation can trigger before a single line of userland PHP executes.

To give infrastructure, SecOps, and enterprise IT teams an immediate, deterministic way to audit exposure and deploy temporary hardening while patch windows are scheduled, Aria Technology Group ( AriaWave ) open-sourced the AriaWave PHP2Shell Readiness & Mitigation Scanner ( ariawave-php2shell-scanner ) .

1.…