Welcome to INTEGRITY labs, the repository of public security research performed by our
team.
Here you can find advisories, articles and
tools we have published.
PHP2Shell: Critical Pre-Auth RCE in the PHP Interpreter Itself
CVE-2026-109618 & CVE-2026-109619: what they are, who is actually exposed, and what “just patch it” really means. TL;DR: On 21 October 2026, PHP shipped emergency releases fixing two critical vulnerabilities in the interpreter itself (CVSS v4.0 9.2 each; the 10.0 that circulated with the leak was never PHP’s rating). Both live in the machinery that processes multipart request bodies during request startup, before your application code runs, so the worst case is unauthenticated remote code execution as the web server...