🐞 0-Day Insights: PHP RCE
Independent analysis of PHP CVE-2026-109618 and CVE-2026-109619 from first principles: patch reverse engineering and RCA.
This research note is our independent analysis of both critical PHP bugs that were patched this week, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). We take the code as ground truth and re-evaluate every assumption from the ground up.
In particular, we investigate the root causes and exploitability of both bugs from first principles, starting with the published patch.
The report contains fully worked reverse engineering of the patch with a transparent methodology, evaluation logic, and technical details. Code snippets are linked to the published online codebase: pre-patch code to the PHP 8.5.11 release (the last vulnerable one), patched code to the PHP 8.5.12 release, which ships this fix unchanged.
PoC code is not provided.
Reviewed by Alisa Esage.
