Critical PHP Remote Code Execution Vulnerabilities Prompt Emergency Patch Release

Emergency security patches are anticipated today, October 21, 2026, for two critical Remote Code Execution (RCE) vulnerabilities (CVE-2026-109618, CVE-2026-109619) in PHP core, affecting versions 5 and later. Proof-of-concept exploits have reportedly been released, necessitating urgent action. Users are advised to take internet-facing PHP applications offline or apply immediate mitigations like disabling `session.upload_progress` and blocking multipart requests, with official patches expected for PHP 8.2 and newer.