- Published on
PHP2Shell is two memory bugs in PHP's C core, CVE-2026-109618 and CVE-2026-109619. This short course explains what the bugs are, why no login is needed and why they can fire before your code runs, what to update today, and why the same use-after-free is a compile error in safe Rust.