Critical Remote Code Execution Flaws Found in PHP Core

Two critical remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619) with a CVSS v4.0 score of 9.2 have been confirmed in PHP core. An out-of-band security release is scheduled for October 21, 2026, at 14:00 UTC. These flaws affect all PHP versions from PHP 5 onwards, impacting widely used platforms like WordPress, Drupal, and Adobe Commerce, necessitating immediate patching for organizations.