(huntress.com) Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619: Urgent Patch Advisory and Threat Landscape In brief - This article discusses two critical remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) that were leaked prior to their official disclosure. It provides guidance on preparing for the security patches and monitoring for potential exploitation. Technically - This article describes critical RCE flaws in the PHP core, potentially affecting versions 5 through 8, with a CVSS v4.0 rating of 9.2. While the root cause is not yet public, the author notes that exploitation (referred to as "php2shell") is expected to manifest as suspicious child processes spawned by PHP workers such as php-fpm, php-cgi, or apache2. Specifically, defenders should monitor for these processes launching shells (bash, cmd.exe), interpreters (python, perl), or networking tools (curl, wget, nc), as well as reconnaissance commands like 'whoami' or reverse shell patterns involving '/dev/tcp/' and 'fsockopen'. Source: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities #Cybersecurity