PHP Is Broken?! CVE-2026-109618 and 109619 Explained, Patch Today

Get GPUs Runpod: https://get.runpod.io/pe48 Get Hostinger: https://www.hostg.xyz/SHJiu Coupon Code "PROMPT" 10% discount CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) explained: two 9.2/10 bugs inside PHP itself that can give an unauthenticated attacker code execution as the web worker. Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Update, then restart every PHP worker. I explain both bugs with one interactive machine (a cook, a workbench and a noticeboard), then cover who is affected, whether people are really being hacked, and the exact steps for today. Everything comes from the advisories and the finders. I ran no exploit and have no PHP installed here to test. Chapters 0:00 Two bugs inside PHP itself 0:42 The two CVE records 1:40 One machine: the PHP worker kitchen 2:10 Bug one: out of memory (CVE-2026-109618) 3:17 Bug two: stale global state (CVE-2026-109619) 3:51 Why they are worse together 4:48 Are people really being hacked? 5:48 Am I affected? 6:34 What to do today 7:22 How the fix works 7:34 What I cannot tell you Sources shown in the video php.net security advisory: https://www.php.net/ GHSA-w8hw-w9fx-j79w (OOM): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w GHSA-6wmf-4rv5-p3rp (stale state): https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp CVE records: https://www.cve.org/CVERecord?id=CVE-2026-109618 and https://www.cve.org/CVERecord?id=CVE-2026-109619 Calif (the finders): https://calif.io/php2shell Wiz: https://www.wiz.io/blog/php2shell-php-rce Sansec: https://sansec.io/research/php2shell Tenable FAQ: https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote SecurityWeek: https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/ If you are looking for cheap and reliable GPUs, I use RunPod: RunPod: https://get.runpod.io/pe48 🔗 Connect with me: Email → [email protected] Ko-fi → https://ko-fi.com/promptengineer Patreon → https://www.patreon.com/PromptEngineer975 Book a Call → https://calendly.com/prompt-engineer48/call GitHub → https://github.com/PromptEngineer48 Twitter/X → https://twitter.com/prompt48 Website → https://promptengineer48.com/