Two Serious Remote Code Execution Vulnerabilities in PHP, Patch Expected Tonight

Slow Fog Security Alert states that PHP released a security announcement on October 20, disclosing two serious security vulnerabilities, numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. Currently, the PHP official has not released a fix, and the affected versions and exploitation conditions are yet to be confirmed. The PHP official plans to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). Slow Fog recommends that relevant institutions promptly check the PHP versions in their servers and business systems, with a focus on PHP services exposed to the public network, and upgrade in a timely manner after the patch is released; systems that cannot be upgraded temporarily should restrict access sources and take isolation measures if necessary.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.