A deep technical walkthrough of PHP2Shell — how CVE-2026-109618 and CVE-2026-109619 chain an out-of-memory crash into remote code execution in PHP 8.4.26.