⚠️ PATCH NOW
Two critical PHP core flaws (CVE-2026-109618/619, CVSS 9.2) leaked before the patch shipped.
A public proof-of-concept is circulating. The emergency fix covers PHP 8.2 to 8.5.
Running PHP? Update the moment it drops.
https://suriq.io/blog/php-core-rce-cve-2026-109618-php2shell
SuriqPHP CVE-2026-109618 & 109619: Critical Core RCE Leaked EarlyPHP is shipping an emergency fix for two critical CVSS 9.2 core flaws, CVE-2026-109618 and CVE-2026-109619, after details leaked early and a public proof-of-concept appeared. What defenders should do now.