OTX Threat: Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)

Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2, leaked before their scheduled patch on October 21, 2026. The flaws involve out-of-memory corruption in PHP core through multipart/form-data parsing, exploitable via session.upload_progress without authentication. Scanning began approximately 20 minutes after the patch release, wit CVEs: CVE-2025-55182, CVE-2025-32975, CVE-2026-109618, CVE-2026-109619 Sectors: Retail, Finance, Te