Source: isc.sans.edu
PHP.net announced a critical security update addressing two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.4. Due to the severity and widespread use of PHP, ISC SANS elevated the InfoCon level to YELLOW. Early proof-of-concept exploits were reportedly available before the patch was released, increasing the risk of exploitation. The high CVSS score and pre-patch PoC availability make this a high-priority issue for organizations running PHP-based applications. Administrators are strongly urged to apply the patch as soon as it becomes available.
