Initial Assessment – CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”): two heap use-after-free bugs in PHP’s session.upload_progress handler. A crafted unauthenticated multipart/form-data POST to any .php endpoint may lead to RCE under default configuration. Our research team is still evaluating. Fixes are expected today at 14:00 UTC (reportedly 8.5.12, 8.4.27, 8.3.36, 8.2.35); 8.1 and older will not be patched. Until then, set session.upload_progress.enabled=Off in the web-serving PHP config and upgrade once releases are confirmed.