PHP2Shell: Two Critical PHP Flaws and What to Patch

PHP2Shell explained: how CVE-2026-109618 and CVE-2026-109619 can lead to remote code execution on affected PHP web workers, and what to patch. See how out-of-memory corruption and stale state cross request boundaries—and why the PHP version reported by `php -v` may differ from the one serving your site. The upstream fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Distribution packages may include backported fixes. Check your vendor advisory and the live web worker. Temporary configuration changes do not replace a complete patch. CHAPTERS 00:00 The PHP2Shell story 00:42 PHP's reach 01:30 Out-of-memory corruption 02:46 Stale global state 03:42 Impact and deployment conditions 04:19 Defense and patching 05:58 Why `php -v` is not enough OFFICIAL SOURCES OOM corruption advisory: https://github.com/php/php-src/security/ad... Stale global state advisory: https://github.com/php/php-src/security/ad... PHP usage series: https://w3techs.com/technologies/history_o... The 70.8% statistic shown in the video is PHP's share among sites with a known server-side language on 1 July 2026. It is not the share of vulnerable sites. #PHP2Shell #PHPSecurity #CyberSecurity