Right, so we have TWO unpatched CVEs hitting all PHP versions, which are already being exploited (https://x.com/IntCyberDigest/status/2112742167697645728)
And we have a trusted certificate issuer that managed to leak its root certificates (https://x.com/IntCyberDigest/status/2112651162835185926)
Today is going to be one of those days...... 😭
X (formerly Twitter)International Cyber Digest (@IntCyberDigest) on X‼️ BREAKING: Two leaked remote code execution flaws in PHP are real, watchTowr confirms.
PHP will ship fixes for two critical flaws, both rated CVSS 9.2, on Wednesday 21 October at 14:00 UTC, a day before the embargo was due to lift.
CVE-2026-109618 and CVE-2026-109619 first surfaced in a Hacker…
