I wrote up the php2shell RCE (CVE-2026-109618 and CVE-2026-109619): the root cause, the signed-integer primitive, and the paths to a shell on both mod_php and FPM. Reliable exploitation is a lot harder than the headlines made it sound: every chain is pinned to one exact build, so the public PoCs mostly crash on a different one. https://ilia.ws/blog/php2shell-two-ways-php-corrupts-its-own-memory #php #security