The PHP security team has issued a warning about two critical vulnerabilities, both rated CVSS v4.0 score 9.2, urging administrators to prepare for a security release on October 21, 2026. Vulnerabilities CVE-2026-109618 and CVE-2026-109619 could enable remote code execution on affected servers. Reports indicate risks to PHP versions from 5 onwards. Cloudflare observed early exploitation attempts. Administrators should promptly identify PHP applications and prepare for patching, isolating vulnerable systems if necessary. Until the official patches are released, configurations should not be considered safe based solely on circulating claims.
