PHP2Shell: Cross-Request Use-After-Free in PHP Core enables Pre-Auth RCE

PHP2Shell groups four related memory-safety bugs under two critical CVEs (CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2) in the PHP engine itself, the most widely deployed server-side web runtime. The practical impact ranges from silent cross-user memory disclosure to full unauthenticated remote code execution