WuShuo has learned that SlowMist's Chief Information Security Officer, 23pds, posted that PHP has disclosed two critical Remote Code Execution (RCE) vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. Technical details, exploitation conditions, and affected versions have not yet been officially confirmed. The official security update is expected to be released on October 21, 2026, at 14:00 UTC (22:00 Beijing time). SlowMist's asset scan for the crypto industry using PHP highlights the risks, and it is recommended that platforms, DeFi projects, and wallets upgrade and conduct audits. https://www.(wublock123.com)/news/news-70435