PHP Warns of Two Critical 9.2 Security Vulnerabilities, Urges Users to Prepare for Patches

The PHP security team has issued a warning about two critical vulnerabilities, both rated CVSS v4.0 score 9.2, urging administrators to prepare for a security release on October 21, 2026. Vulnerabilities CVE-2026-109618 and CVE-2026-109619 could enable remote code execution on affected servers. Reports indicate risks to PHP versions from 5 onwards. Cloudflare observed early exploitation attempts. Administrators should promptly identify PHP applications and prepare for patching, isolating vulnera