SlowMist and others flag two critical PHP RCE vulnerabilities
SlowMist reported that PHP disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 under CVSS v4.0, with official patches pending. SlowMist said its MistEye system scanned PHP-related crypto assets and urged platforms to upgrade once patched versions are available. Other outlets reported that patches were released or scheduled, that exploits were circulating beforehand, and that the NSA urged users to patch or take systems offline.
