Red code for half the internet: emergency PHP patches fix critical RCE vulnerabilities
On October 21, 2026, the PHP team urgently released patches against two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) whose details leaked prior to release. The exploit is already active in the wild.
Read more →