Critical PHP zero-days CVE-2026-109618 and CVE-2026-109619 enable RCE and are exploited in the wild, affecting PHP 5.4 and later
PHP released an emergency update for two critical zero-day vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They allow remote code execution, denial of service and data exposure, and are reportedly already being exploited in the wild. Nearly 70 percent of websites are said to need updating, and Reuters reports that government website…