[Critical Remote Code Execution Vulnerability in PHP Core Exposed, Official Patch Scheduled for Release Today] Reported by Jinse Finance, on October 21, PHP developers announced plans to release two urgent security updates to address vulnerabilities CVE-2026-109618 and CVE-2026-109619, both with a severity score of 9.2. This alert stems from the leak of a remote code execution tool targeting PHP applications (such as WordPress, Laravel, etc.) called 'PHP2Shell.' Security experts have confirmed the existence of the vulnerabilities and recommend administrators immediately back up data, review application lists, and prepare maintenance windows. Researchers estimate that approximately 1.3 million hosts worldwide are affected. The patch is scheduled for release at 14:00 UTC on October 21 (22:00 Beijing Time). Experts predict that within 15 minutes of the patch release, hackers could reverse-engineer the vulnerability details and deploy large-scale automated attack programs.