Critical RCE vulnerabilities discovered in PHP

Two severe vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been identified in PHP, affecting virtually all versions from PHP 5 onwards. These flaws allow attackers to achieve remote code execution (RCE) on vulnerable web servers. Although active exploitation has not yet been reported, a public Proof of Concept is available. Administrators are strongly advised to prepare for upcoming patches.