{"name":"PHP Exposure Campaign","description":"Exposure inventory for two critical remote code execution vulnerabilities in PHP core (CVE-2026-109618, CVE-2026-109619, CVSS v4.0 9.2). The PHP security team scheduled the fix for 21 October 2026 at 14:00 UTC, and it is expected only for supported PHP 8 branches. PHP 5.x, 7.x, 8.0 and 8.1 are not expected to receive a fix.\n\nThis campaign surfaces every asset where PHP is detected, so teams can prioritise internet-facing hosts, patch supported branches at release, and migrate or isolate end-of-life hosts.\n\nFull analysis: https://phoenix.security/blog/php-core-rce-cve-2026-109618-109619-critical-remote-code-execution"}