PHP warns of emergency patches for two leaked critical RCE flaws, CVE-2026-109618 and CVE-2026-109619
The PHP security team has warned administrators to prepare for emergency security updates on October 21 at 14:00 UTC, fixing two critical vulnerabilities each rated 9.2 under CVSS v4.0. Information about the flaws reportedly leaked ahead of the planned embargo, and the team says it may release earlier if details become public or exploitat…