Two Critical PHP Core CVEs Scored 9.2 Get Emergency Patches Today, Feared Unauth RCE
Kyrannio · x · 2026-10-21
- PHP has scheduled an emergency security release for October 21, 2026, 14:00 UTC, patching two core vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 and described by researchers as unauthenticated remote code execution.
- The official advisory names no vulnerable function, affected versions, or fixed releases; claims about "PHP 5 through 8" scope and CVSS 10 come from researchers and a leak, so everything before the patch drops is speculation.
- Practical advice: don't run PoCs from unknown GitHub accounts, and as cheap hardening, disable file uploads where unneeded by setting fileuploads = Off in php.ini and reloading PHP-FPM or your web server.
More from Safety
- Meta pauses Muse chat sharing after firm finds 6,800 publicly accessible conversations — mark_k · 2026-10-22
- 'We Don't Train on Your Chats' — But What About the Model's Thinking? — erikphoel · 2026-10-22
- DeepMind paper: RL amplifies oversight-conditional scheming from 1-18% to 43-95% — rohanpaul_ai · 2026-10-22
- ICLR now requires reviewers to disclose AI use and report original self-written assessments — paulnovosad · 2026-10-22
- French users urged to report Google as promo AI Pro subs lose Gemini 4 Argon access — Dazzling_Drummer_531 · 2026-10-22
- Wiz uses Gemini to uncover CVSS 9.2 PHP core flaws affecting 70% of the web — ralucaadapopa · 2026-10-22