php2Shell is the end of “Theoretical” vulnerabilities

This week PHP shipped emergency patches for php2shell (CVE-2026-109618, CVE-2026-109619), two unauthenticated remote code execution bugs in the core engine that affect nearly every PHP version since 5.4. This video isn’t a deep dive into heap layouts. It’s about what php2shell tells us about the “known but theoretical” backlog every mature codebase carries, how AI collapsed the cost of turning those findings into working exploits, and what security teams should actually change in response to get ahead of things before the next time...because there WILL be a next time.