Recent major disclosures of two critical unauthenticated remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) in PHP's core request handling, including out-of-memory corruption and stale global state issues, drove the market's "No" odds to 74%. These flaws, nicknamed php2shell and affecting supported branches back to older versions, prompted emergency patches released October 21 into 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with CISA adding them to its KEV catalog. Heightened scrutiny from researchers and the PHP team, combined with rapid remediation across deployments like mod_php and PHP-FPM, has reduced expectations of another critical flaw before year-end. A third lower-risk issue (CVE-2026-115560) requires unusual configurations and needs no out-of-band fix, further supporting trader consensus on limited near-term risk.