Two critical PHP core vulnerabilities enable pre-application RCE with CVSS 9.2. Cloudflare and Amazon confirm active exploitation. When the engine itself is compromised, https://deafnews.it/en/article/php2shell-when-the-engine-becomes-the-target-every-downstream-defense-fails