OTX Threat: PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619

Two critical remote code execution vulnerabilities in PHP, collectively named PHP2Shell, were disclosed on October 21, 2026. CVE-2026-109618 involves out-of-memory handling corruption that can interrupt PHP while internal request data is partially initialized, leading to invalid data treatment. CVE-2026-109619 exploits stale global state where request-owned internal state survives after memory is CVEs: CVE-2026-109618, CVE-2026-109619