OTX Threat: PHP2Shell (CVE-2026-109618/9) Havoc: UNC actors leveraging Public Exploit Code Against Public, Business And Educational Infrastructure

Two critical use-after-free vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2, affect the session.upload_progress feature. These flaws trigger during multipart request parsing before application code executes, bypassing WAFs and enabling unauthenticated remote code execution. Within 48 hours of the October 21, 2026 patch release, exploit code spread rapidly acr CVEs: CVE-2026-109618, CVE-2026-109619 Sectors: Education, Government, Healthcare