Upcoming Critical PHP Security Release - CVE-2026-109618 & CVE-2026-109619
Bad day to be us...
Apparently created a PoC just from the video of the original PoC. But PHP and others have said there are zero mitigations. So doesn't matter what you do... You're fucked.
https://www.php.net/archive/2026.php#2026-10-20-1Open linkView original on reddthat.com
1 reply
Seems it's been corrected to not RCE already.