SlowMist: PHP discloses two critical remote code execution vulnerabilities, both with a CVSS v4.0 score of 9.2

October 21: SlowMist issued a statement saying that PHP released a security advisory on October 20, disclosing two critical vulnerabilities that may lead to remote code execution (RCE), numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. Official patches have not yet been released, and the technical details, exploitation conditions, and affected versions of the vulnerabilities have not yet been officially confirmed.

Third-party reports claim that PHP 5 and subsequent versions may be affected, but this scope has not been verified. Officials are expected to release a security update on October 21 at 14:00 UTC (22:00 Beijing time).

SlowMist recommends that relevant teams check the PHP versions in servers and business systems, prioritize investigating Internet-facing services, and update as soon as possible after official patches are released. If remediation is temporarily impossible, access to exposed PHP services should be restricted and, if necessary, isolated.