(aikido.dev) Critical Remote Code Execution Vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619 In brief - This article alerts users to two critical remote code execution vulnerabilities in PHP and announces the upcoming release of official patches. Technically - This article identifies CVE-2026-109618 and CVE-2026-109619 as critical remote code execution (RCE) flaws affecting all versions of PHP. Both vulnerabilities carry a high severity rating with a CVSS v4.0 score of 9.2, and while specific exploitation vectors are currently withheld to facilitate patching, the PHP security team is coordinating a fix release for October 21, 2026. Source: https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell #Cybersecurity