PHP2Shell: How One Request Became RCE, and the Fix
PHP2Shell is the nickname for two critical PHP runtime flaws, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. Together they let an attacker run commands on a web server with one malformed request and no login. Exploitation started on 17 October, four days before PHP shipped fixes on 21 October.
This post walks the attack chain, the response that actually closes it, and the cleanup that patching alone never does. Everything here mirrors our free PHP2Shell RCE exercise, where you play both the attacker and the engineer on call.