🚨 SlowMist TI Alert: Two Critical PHP Remote Code Execution (RCE) Vulnerabilities Disclosed 🚨 🔴 Severity: Critical 📌 CVEs: CVE-2026-109618, CVE-2026-109619 ⚠️ CVSS v4.0: 9.2 for both vulnerabilities 🛠️ Patch Status: Official patches pending On October 20, 2026, PHP published a security advisory confirming two critical vulnerabilities that could lead to remote code execution (#RCE). According to CERT-EU and security researchers, the vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Technical details, exploitation conditions, and affected versions have not yet been officially confirmed. Third-party reports suggest that PHP 5 and later versions may be affected, but the scope remains unverified. 📅 Expected Security Update: October 21, 2026, at 14:00 UTC (22:00 UTC+8). 🛡️ Security Recommendations 1️⃣ Audit PHP versions across servers and business systems, prioritizing internet-facing services. 2️⃣ Monitor official PHP updates and apply patched versions as soon as they become available. 3️⃣ Restrict access to exposed PHP services and consider isolating them if immediate patching is not possible. 🔗 References: PHP Official Advisory: https://www.php.net/archive/2026.php#2026-10-20-1CERT-EU Advisory: https://cert.europa.eu/publications/security-advisories/2026-018/