PHP discloses two critical remote code execution vulnerabilities, with security updates to be released tonight.

PANews October 21 news: According to SlowMist, PHP released a security advisory on October 20, confirming the existence of two critical vulnerabilities that may lead to remote code execution (RCE), numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. Official patches have not yet been released. The PHP security team is expected to release a security update at 22:00 on October 21 (UTC+8); if vulnerability details are disclosed earlier or signs of actual exploitation are discovered, it will be released ahead of schedule. The technical details of the vulnerabilities and affected versions have not yet been officially confirmed, and third-party reports state that PHP 5 and later versions may be affected. SlowMist recommends checking PHP versions and prioritizing services exposed to the public internet; for those that cannot be patched temporarily, externally exposed PHP services should be restricted or isolated. It is understood that PHP is widely used for websites and server backends, and Web services built on PHP, such as crypto trading platforms, project official websites, and payment gateways, may be affected, with attackers potentially able to remotely control servers through the vulnerabilities. SlowMist recommends checking PHP versions and prioritizing patching services exposed to the public internet.