PHP discloses two critical remote code execution vulnerabilities; security update expected on October 21

October 21 - According to SlowMist, PHP issued a security advisory on October 20 confirming two critical vulnerabilities that could lead to remote code execution (RCE), identified as CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. Official patches have not yet been released. The PHP security team expects to release a security update at 22:00 (UTC+8) on October 21; if vulnerability details are disclosed early, or signs of active exploitation are found, the update will be released earlier. Technical details of the vulnerabilities and affected versions have not yet been officially confirmed, and third-party reports indicate that PHP 5 and later versions may be affected. SlowMist recommends checking PHP versions and prioritizing services exposed to the public internet; for those that cannot be patched temporarily, PHP services exposed externally should be restricted or isolated.
It is understood that PHP is widely used for websites and server backends. Web services built on PHP, such as crypto trading platforms, project official websites, and payment gateways, may be affected, and attackers could potentially exploit the vulnerabilities to remotely control servers. SlowMist recommends checking PHP versions and prioritizing patching of services exposed to the public internet.