Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming
Summary not yet generated for this article.
Original Text
A reliable source has indicated an announcement is scheduled for 22 October 2026 at 18:00 CEST regarding 2x PHP RCEs with a CVSS score of 10.0.
I have no evidence beyond "source: trust me, bro", but if you're running PHP in production, be ready to update as a priority.
These CVEs reportedly relate to remote code execution in all affected PHP versions from PHP 5 onwards.
These are the two reserved CVEs for the reported upcoming announcement:
CVE-2026-109618
CVE-2026-109619
Comments (60 of ) ⌛