- 21st October 2026
Two critical remote code execution vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2 by the PHP security team. Leaked community reports circulated a higher CVSS 10.0 figure; the official rating is 9.2.
Marcus Webb



















