Two critical PHP Remote Code Execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 20, 2026, with a CVSS score of 9.2
Two critical PHP Remote Code Execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 20, 2026, with a CVSS score of 9.2. Official patches are pending.
- Confidence
- High
- First seen
- 21 Oct 2026, 02:58 UTC