PHP2Shell Explained: PHP2Shell Was in the Training Data

Today at 14:00 UTC, the PHP project shipped emergency security releases (8.5.12, 8.4.27, 8.3.36, and 8.2.35) to fix 2 critical vulnerabilities in the core PHP engine: CVE-2026-109618 and CVE-2026-109619. Collectively tracked as PHP2Shell and rated 9.2 under CVSS v4.0 by the PHP security team (and a straight 10.0 by several independent researchers), the bugs allow an unauthenticated attacker over the open internet to leak live server memory and execute arbitrary shell commands on standard PHP deployments.If you run PHP anywhere on the public internet, stop reading and go patch. Because the defects sit inside the C runtime below the application layer, your own code cannot protect you. Working exploits have already been validated against out-of-the-box installs of WordPress, Laravel, Symfony, Drupal, Joomla, Magento, MediaWiki, Nextcloud, and Roundcube.Once your servers are patched, look at the narrative already forming around how PHP2Shell was found. According to Wiz Research and Google…