PHP2Shell Bugs and The Impact for Defenders | Ben Harris

The newly disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are as serious as everyone feared, and Ben Harris of watchTowr joins Dennis Fisher to discuss their long-term impact.Timestamps00:00 - Introduction and why the PHP bugs are a big deal00:22 - The disclosure process starts to unravel01:04 - Why the two PHP vulnerabilities are so severe02:07 - Why the embargo mattered and why the leak was dangerous02:49 - PHP’s massive footprint across the internet04:08 - What mitigations can and cannot do05:35 - Comparing this to Log4Shell06:32 - Why sysadmins outside security are suddenly paying attention07:22 - Why old assumptions about disclosure may no longer hold08:48 - How LLMs accelerate reproduction from tiny clues09:13 - Why even partial screenshots and leaked video can be enough10:33 - A rough six to twelve months ahead for security teamsLinksPHP blog: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/Our story: https://decipher.sc/2026/10/20/critical-php-flaws-disclosed-patches-out-now/