22/10/2026
๐จ Critical Alert for Server Admins & Developers: Two severe core-level RCE zero-daysโknown as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) with a CVSS score of 9.2โare actively being exploited in the wild.
Unlike traditional web shells, PHP2Shell targets the PHP interpreter engine itself, bypassing application-level authentication entirely. Weโve broken down what these memory-safety vulnerabilities mean, why they are uniquely dangerous, and the urgent remediation steps your team needs to take right now (including required patch versions and worker restarts).
Read the full breakdown here: https://acorn-media.co.uk/news-article?slug=breaking-down-php2shell-the-zero-day-core-vulnerabilities-cve-2026-109618-cve-2026-109619-and-how-to-defend-your-servers