A new deep dive examines PHP2Shell, showing how CVE-2026-109618 and CVE-2026-109619 chain an out-of-memory crash into remote code execution in PHP 8.4.26. The walkthrough details heap grooming, a use-after-free, zend_string forgery, and the full exploit pipeline.