PHP2Shell: CVE-2026-109618 & CVE-2026-109619, PoC and Fixes
Two critical PHP CVEs landed on 21 October 2026, and this is not another vulnerable WordPress plugin story. The problem is underneath the application, inside PHP’s request lifecycle. That is the part I care about when looking at this from a vulnerability assessment and penetration testing (VAPT) perspective. Your application can have sensible authentication, clean input validation and a green static application security testing (SAST) report, and still sit on a vulnerable interpreter. ...