OrcaCyber Zero 1.5 Discovers and Analyzes PHP2Shell Vulnerability

OrcaCyber Zero 1.5, a cybersecurity-focused model, autonomously investigated and built a working proof-of-concept for the PHP2Shell vulnerability. The vulnerability, also known as CVE-2026-109618 and CVE-2026-109619, affects PHP versions 5.4 and later. It allows for remote code execution (RCE) without authentication and has a CVSS v4.0 score of 9.2, classified as Critical. The vulnerability was fixed in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, released on October 21, 2026. The investigation was conducted in a isolated lab environment and the results, including source analysis and defense verification scripts, are publicly available on GitHub. The attack code is not provided. The researchers used the OrcaCyber Zero 1.5 model and the OrcaCyber Ultra 1.0 model to investigate the vulnerability. They recreated the proof-of-concept in a Docker lab environment and observed the vulnerability’s mechanism, including crash logs and abnormal session cookies. The researchers also confirmed that the vulnerability was fixed in PHP 8.4.27.