The official advisory and patches have been released. We are continue to track emergence of proofs-of-concept and exploits.
https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914
IFINCVE-2026-109618, CVE-2026-109619: Remote Code Execution in PHPCVSSv3: 9.2 Last Updated: 2026-10-21T14:06:57Z (UTC) What’s Happening On 2026-10-21T07:00:00Z (UTC), PHP published an advisory about two critical vulnerabilities in PHP. The GitHub security issue has also now been published. Earlier unsubstantiated reports put the CVSS at 10.0, and claimed that versions back to PHP 5 (8.5 is current) would be impacted. Researcher and Sigma rule creator Flor