PHP just found two bugs that have been chilling in the interpreter since ~2004. Older than Laravel. Older than GitHub. Some of you were in primary school when these were committed 😅
php2shell (CVE-2026-109618 + 109619), CVSS 9.2, unauthenticated RCE. On mod_php it fires before…
Commit
7b4ac30