The PHP Group

Security researcher Ariane Djad has published an in-depth technical analysis of PHP2Shell, systematically dissecting the full exploit chain formed by CVE-2026-109618 and CVE-2026-109619, with heap dumps, PoC source code and interactive visualizations released on GitHub. The work fills a gap left by earlier surface-level write-ups and offers direct reference value for securing the PHP ecosystem.