SlowMist: PHP discloses two critical remote code execution vulnerabilities, both with a CVSS v4.0 score of 9.2

SlowMist issued a statement noting that PHP published a security advisory on October 20, disclosing two critical vulnerabilities that could lead to remote code execution (RCE), with CVE identifiers CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 on the CVSS v4.0 scale. No official patch has been released to date, and the vulnerabilities’ technical details, exploitation conditions, and affected versions remain unconfirmed by the PHP project. Third-party reports suggest PHP 5 and subsequent versions may be impacted, though this scope has not been verified. The official is expected to roll out a security update at 14:00 UTC (22:00 Beijing time) on October 21. SlowMist recommends relevant teams audit PHP versions across their servers and business systems, prioritize checking internet-facing services, and update immediately after the official patch becomes available. If a fix is not immediately feasible, restrict access to exposed PHP services and isolate them if needed.