[SlowMist Security Alert: Two Severe Remote Code Execution Vulnerabilities Discovered in PHP, Official Patch Expected Tonight] Odaily Planet Daily reports that SlowMist Security Alert indicates PHP issued a security announcement on October 20, disclosing two severe security vulnerabilities that could lead to remote code execution (RCE), identified as CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. Currently, the official PHP team has not released a fix patch, and the specific affected versions and exploitation conditions of the vulnerabilities are yet to be confirmed. Based on existing information, the PHP team plans to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). SlowMist recommends that relevant organizations promptly inspect the PHP versions in their servers and business systems, with a focus on PHP services exposed to the public internet. After the patch is released, systems should be upgraded immediately; for systems unable to upgrade temporarily, access sources should be restricted, and isolation measures should be implemented if necessary.