01 / QUESTION
The question.
Hollowing examined the publicly disclosed PHP2Shell issues in a Windows Apache and PHP lab. The vulnerabilities were reported by Wiz, Ryan Austin of Calif.io and OpenAI; this work is a local reproduction, not their discovery.
02 / SETUP
How it was studied.
The recorded comparison used PHP 8.4.26 and patched PHP 8.4.27 with Apache mod_php on the same local machine.
03 / OBSERVATIONS
What happened.
- For CVE-2026-109619, the cited raw receipts show three crashes on the vulnerable version and three clean outcomes on the patched version.
- For CVE-2026-109618, the local work reached an out-of-memory path; its report does not claim a local demonstration of remote code execution.
04 / EVIDENCE
Behind the result.
Hollowing PHP2Shell report and local 619-vuln and 619-patched receipts, 22 October 2026. The detailed lab records are held locally and are not yet published.
05 / LIMITATIONS
What this does not establish.
The observed crash comparison is specific to this lab configuration and is not a demonstration of controlled code execution. The report mentions a five-run comparison, but the cited raw receipts contain three outcomes per version. Vendor advisories are the authoritative source for affected versions and remediation.
RELATED PROJECT