PHP leaked critical RCE flaws CVE-2026-109618 and CVE-2026-109619 (php2shell): patches due Oct 21, all versions treated as affected
Aikido warns that two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP itself, and it advises treating all versions as affected. Both are rated CVSS v4.0 9.2. The PHP security team will release fixes at 14:00 UTC on October 21, 2026. Aikido is coordinating the disclosure with the PHP Foundati…