[PHP Discloses Two Critical Remote Code Execution Vulnerabilities, Security Update to Be Released on October 21] According to SlowMist, PHP issued a security advisory on October 20, confirming the existence of two critical vulnerabilities that could lead to remote code execution (RCE), identified as CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. The official patch has not yet been released. The PHP security team expects to release a security update on October 21 at 22:00 (UTC+8). If the vulnerability details are disclosed prematurely or signs of active exploitation are detected, the update will be released earlier. The technical details and affected versions of the vulnerabilities have not been officially confirmed, but third-party reports suggest that PHP versions 5 and later may be affected. SlowMist recommends checking PHP versions and prioritizing the handling of services exposed to the public internet. For systems that cannot be patched immediately, it is advised to restrict or isolate externally exposed PHP services.