SlowMist Security Alert: PHP Exposed with Two Critical Remote Code Execution Vulnerabilities, Official Patch Expected Tonight

Odaily reports that SlowMist has issued a security alert stating that PHP released a security advisory on October 20, disclosing two critical security vulnerabilities that could lead to remote code execution (RCE), tracked as CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. Currently, PHP officials have not yet released a fix patch, and the specific affected versions and exploitation conditions remain to be confirmed.

According to available information, PHP officials plan to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). SlowMist recommends that relevant organizations promptly check the PHP versions in their servers and business systems, with particular attention to PHP services exposed to the public internet, and upgrade in a timely manner once the patch is released; systems that cannot be upgraded immediately should restrict access sources and take isolation measures when necessary.